I was trying to raise awareness of XSS attacks on a website, by launching a harmless XSS attack and showing the follow message if users fell for it:



I want my message to sound serious, but 'a bad guy' seems informal. I quickly Googled a list of synonyms, but, as a non-native speaker, couldn't figure out which fits more in this content. Can you provide suggestions?

Well, maybe I should tell my professor his site is flawed directly.

  • 2
    Well, there's always "malefactor". And that word likely has a bunch of synonyms, if you look. In fact -- wrongdoer, miscreant, offender, criminal, culprit, villain, lawbreaker, felon, evildoer, delinquent, hooligan, hoodlum.
    – Hot Licks
    Commented Sep 18, 2015 at 19:09
  • 2
    You know, the trend these days is to use plain and informal language for user messages. I have noticed Google in particular doing that. I think "bad guy" is okay. This was an XSS attack. If I had been a bad guy, I could have stolen your account.
    – dangph
    Commented Sep 19, 2015 at 1:15
  • 2
    Making an XSS attack on a website that shows people that message without consent is still likely a crime. The responsible and legal way to deal with the situation would be to tell the website owner directly about the issue.
    – Christian
    Commented Sep 19, 2015 at 15:53

5 Answers 5


I would change the wording to refer more to the attack than the person.

"Had it been malicious, your account would have been stolen."

  • 1
    Excellent point. I couldn't put my finger on why using a noun here felt... somehow wrong. Adjective is the way to go.
    – smci
    Commented Sep 19, 2015 at 9:07

Attacker fits the tone of rest of the message, and in prticular the use of the word attack. By adding real or actual you can differentiate yourself from the "bad guy" since you are technically using the vulnerability yourself.

Malicious user can be an alternative, since it directly describes the bad behavior.

Adversary is often used in infosec, but is typically used in a more hypothetical and technical tone and might not fit you warning message.

The site has an XSS vulnerability. An adversary could execute client-side code under conditions X and Y.


I think people understand hacker in this context.

Had it been made by a hacker, your account would have been stolen.

  • 4
    Wasn't it made by a hacker in any case? (Albeit one with good intentions.)
    – herisson
    Commented Sep 18, 2015 at 20:37
  • 6
    In the software field, there's a difference between the word "hacker" and "cracker", the latter being the black-hat type. I think it would be more correct to go with the other answer above, the one using the phrase "Had it been malicious..."
    – Zwi
    Commented Sep 18, 2015 at 21:19
  • The Wikipedia entry for Hacker (en.wikipedia.org/wiki/Hacker_(computer_security)) has Eric S. Raymond distinguishing crackers (underground) from hackers (ethical). However, in common parlance (which is what the OP is asking for), hackers carry a connotation of the "bad guys." @Zwi, can you cite any movies or books that portray the hacker as a "good guy"?
    – rajah9
    Commented Sep 20, 2015 at 23:33
  • I currently work in the software field, @Zwi, and have worked in combating viruses and vulnerabilities. The term "hacker" always had a negative connotation.
    – rajah9
    Commented Sep 20, 2015 at 23:37

Antagonist or real attacker seem like they might work here.

  • 2
    Antagonist is generally used when referring to fiction. It sounds odd hearing people in real life referred to as antagonists.
    – Eagle-Eye
    Commented Sep 19, 2015 at 4:49


Had it be done irresponsibly, you would have lost your account.

Because of course it's an action

done or said without thinking of the possible results of your actions or words

It fits better for illegal attacks, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.