Random story....
One of my favorite low-effort hacks was when I used a type2 XSS injection of <marquee> into a work ticket so the appdev team had to chase the entire ticket across the screen to get to the close button.
The devs said "How? We blocked scripts!"
Even more fun, when they "blocked scripts" they only removed "<scr1pt>" in a single pass, so I injected "<scr<scr1pt>ipt>" and chaos ensued.
Then they switched to ColdFusion's native XSS protection, so I used "<body onload.." and yay more XSS.
Good times. Now I'm a PM.
Follow
Lol I had to change the i's to 1's in the word "script." I blame @th3j35t3r.