Port scanning from a web page, combined with DNS rebinding, can present a really nasty attack, and can effect an entire private network, not just localhost. So

Port scanning from a web page, combined with DNS rebinding, can present a really nasty attack, and can effect an entire private network, not just localhost. Some more info here: https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 https://medium.com/@brannondorsey/attacking-private-networks... Example code: https://github.com/brannondorsey/dns-rebind-toolkit https://github.com/brannondorsey/dns-rebind-toolkit A malicious DNS rebind server: https://github.com/brannondorsey/whonow https://github.com/brannondorsey/whonow Disclaimer: I performed some of this research a few years ago. So those resource suggestions are my own, but they feel very relevant here.