[meesterdude]

> I regularly encounter users who don't accept that websites can access services on localhost or their intranet," Ormandy wrote. "These users understand that services bound to localhost are only accessible to software running on the local machine and that their browser is running on the local machine—but somehow believe that accessing a website 'transfers' execution somewhere else. It doesn't work like that, but this is a common source of confusion."

does this mean a malicious site can query data from a running service, such as local MySQL? If so, isn't that a big deal? I know lots of places that run things open locally because they're behind a firewall.

[sannee]

As MySQL uses a custom binary protocol, it should be fine. On the other hand, anything using a line-based protocol is in danger.

https://bouk.co/blog/hacking-developers/

So, if you have, say, telnet bound to localhost without a password, you are not safe (modern browser would drop the response as it's not valid HTTP, but with telnet you don't exactly care anyway).