It's always been the case, back to NCSA Mosaic in 1993, that web pages could hit URLs of local web servers. Before javascript, you had to use an embedded image,

It's always been the case, back to NCSA Mosaic in 1993, that web pages could hit URLs of local web servers. Before javascript, you had to use an embedded image, like: <img src="http://192.168.1.1/cgi-bin/reboot-router"> http://192.168.1.1/cgi-bin/reboot-router"> And it didn't have to be port 80 -- you could try fuzzing someone's X server with <img src="http://127.0.0.1:6000/lsjdfjlk23jlrkj"> http://127.0.0.1:6000/lsjdfjlk23jlrkj"> Fortunately, most protocols bail out on the first 4 bytes "GET ". One of the reasons that Gopher support was phased out was that you could make a gopher request contain more or less arbitrary bytes and attack many local servers. Servers have always had the burden of defending against this.