I do not consider myself a hacker, I know how to, and understand current methods that in turn sometimes I end up finding my own when I get free time or an "itch"  For two decades aol instant messenger was a very popular instant message client.  This vulnerability that I found was pretty bad as it required no user intervention what so ever.  I used on on error local xss built into the client.  The only way this was patched was server side looking for this specific string.