Robert Hansen

His XSS Cheat Sheet on ha.ckers.org was a long catalogue of ways to sneak JavaScript past naive filters: half-closed tags, odd encodings, attributes nobody had thought to block. Defenders and attackers used it in roughly equal measure, and it was later donated to OWASP.

In 2008 he and Jeremiah Grossman coined the term clickjacking; their talk was postponed at Adobe's request because Flash was involved. In 2009 he released Slowloris, which takes down Apache servers with a handful of slow HTTP connections rather than a flood of traffic.