Filesystem analysis tool/directory looking for interesting stuff.
Check for backup artifacts that may disclose the web-application's source code.
Find critical backup files by creating a dynamic wordlist based on the domain.