Not quite open internet, but ages ago in highschool I discovered that Blackboard had a rather severe vulnerability with how it handled file uploads for homework submissions that would give you write access to anything it could access (It’s since been patched, this was almost a decade ago).

I used my newfound power to overwrite the Blackboard logo with an animated gif of the same logo that was visually identical to the original. However, the gif had a second frame and would switch to a picture of an angry hissing goose after several minutes.

Why a goose instead of porn or something shocking? Because I didn’t want to offend anyone save from a particular couple of control freak lab administrators. And boy, did it ever work – they went absolutely apeshit trying to figure out where it was coming from, yet neither of them realized that web browsers will happily display animated gifs even if their extensions are jpg. The stealth goose lasted the entire semester, only disappearing with an (assumed) reinstall of Blackboard over the break, which unfortunately patched the vulnerability.