In high school I port-scanned the entire district network internally and sent direct prints to district HQ printers complaining about their lack of segmentation.
@SwiftOnSecurity I ended up finding the district datacenter and a whole pile of Very Vulnerable Servers. that was a fun time