Random story....
One of my favorite low-effort hacks was when I used a type2 XSS injection of <marquee> into a work ticket so the appdev team had to chase the entire ticket across the screen to get to the close button.
The devs said "How? We blocked scripts!"
Even more fun, when they "blocked scripts" they only removed "<scr1pt>" in a single pass, so I injected "<scr<scr1pt>ipt>" and chaos ensued.
Then they switched to ColdFusion's native XSS protection, so I used "<body onload.." and yay more XSS.
Good times. Now I'm a PM.
@kimmy
Cold Fusion... now that is a name I haven't seen in a long time
@Beerdini don't say it a third time or it will come back!