Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an attacker gets this user to view a malicious website, is there anything, or any way to stop the attacker from including a script on the page that accesses this internal site, and even possibly running an exploit on it (as internal sites often have more lax security), all from the user's privileged network position?
Even if the attacker doesn't know the exact nature of the internal services, things like port scanning can now be done with javascript: http://blog.andlabs.org/2010/12/port-scanning-with-html5-and-js-recon.html