Legal portals are also many times vulnerable to a form of directory traversal, where you descend the URL scheme by cropping out the last slash. ie. /documents/17683/ would become /documents/. Doing the same thing for parameters can do wonders.
So far I've found login portals to a few banks, teleoperators and to the parliament and military systems of my country. In addition, I've hit several FTP directories of organizations such as my state's public welfare system, which included software and documents.
I sometimes report these incodents as I find them, anonymously and without contact information, since nobody never responds to these reports.
