I was trying to raise awareness of XSS attacks on a website, by launching a harmless XSS attack and showing the follow message if users fell for it:



I want my message to sound serious, but 'a bad guy' seems informal. I quickly Googled a list of synonyms, but, as a non-native speaker, couldn't figure out which fits more in this content. Can you provide suggestions?

Well, maybe I should tell my professor his site is flawed directly.

  • 2
    Well, there's always "malefactor". And that word likely has a bunch of synonyms, if you look. In fact -- wrongdoer, miscreant, offender, criminal, culprit, villain, lawbreaker, felon, evildoer, delinquent, hooligan, hoodlum. – Hot Licks Sep 18 '15 at 19:09
  • 2
    You know, the trend these days is to use plain and informal language for user messages. I have noticed Google in particular doing that. I think "bad guy" is okay. This was an XSS attack. If I had been a bad guy, I could have stolen your account. – dangph Sep 19 '15 at 1:15
  • 2
    Making an XSS attack on a website that shows people that message without consent is still likely a crime. The responsible and legal way to deal with the situation would be to tell the website owner directly about the issue. – Christian Sep 19 '15 at 15:53

I would change the wording to refer more to the attack than the person.

"Had it been malicious, your account would have been stolen."

  • 1
    Excellent point. I couldn't put my finger on why using a noun here felt... somehow wrong. Adjective is the way to go. – smci Sep 19 '15 at 9:07

Attacker fits the tone of rest of the message, and in prticular the use of the word attack. By adding real or actual you can differentiate yourself from the "bad guy" since you are technically using the vulnerability yourself.

Malicious user can be an alternative, since it directly describes the bad behavior.

Adversary is often used in infosec, but is typically used in a more hypothetical and technical tone and might not fit you warning message.

The site has an XSS vulnerability. An adversary could execute client-side code under conditions X and Y.


I think people understand hacker in this context.

Had it been made by a hacker, your account would have been stolen.

  • 4
    Wasn't it made by a hacker in any case? (Albeit one with good intentions.) – herisson Sep 18 '15 at 20:37
  • 6
    In the software field, there's a difference between the word "hacker" and "cracker", the latter being the black-hat type. I think it would be more correct to go with the other answer above, the one using the phrase "Had it been malicious..." – Zwi Sep 18 '15 at 21:19
  • The Wikipedia entry for Hacker (en.wikipedia.org/wiki/Hacker_(computer_security)) has Eric S. Raymond distinguishing crackers (underground) from hackers (ethical). However, in common parlance (which is what the OP is asking for), hackers carry a connotation of the "bad guys." @Zwi, can you cite any movies or books that portray the hacker as a "good guy"? – rajah9 Sep 20 '15 at 23:33
  • I currently work in the software field, @Zwi, and have worked in combating viruses and vulnerabilities. The term "hacker" always had a negative connotation. – rajah9 Sep 20 '15 at 23:37

Antagonist or real attacker seem like they might work here.

  • 2
    Antagonist is generally used when referring to fiction. It sounds odd hearing people in real life referred to as antagonists. – Eagle-Eye Sep 19 '15 at 4:49


Had it be done irresponsibly, you would have lost your account.

Because of course it's an action

done or said without thinking of the possible results of your actions or words

It fits better for illegal attacks, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.