I often tell this story when people ask what I do.

One of my first web application pentests I ever did was on a really old custom web application.

I found that you could upload any size file to set as your profile picture as long as it ended with .jpg or .png