Clawing holes in NAT with UPnP

Our technique allows the attacker (us) to craft a website which, when visited, will cause the victim to inadvertently forward any port of our choice through their NAT, allowing us to connect directly to them inside their private network via UPnP.

http://www.phrack.com/