How does a "What is my IP" site know my internal LAN address?

Question

I'm staying in a hotel right now, and I wanted to see what my external IP address was. I visited a common site that helps with this, and it reported my address as ... (last few digits omitted for privacy)

Your IP Address Is: 69.165.XXX.XXX

Local Network IPs Detected: 10.1.XXX.XXX

Possible Proxy Detected: 1.1 localhost:3128 (squid/2.7.STABLE9)

The network IP is indeed the correct value. This confuses me because I don't think any browser would share this information. My guess is that the request header is being rewritten by Squid. In any event, this is a slightly bothersome privacy issue.

Answer 1

It uses a WebRTC method to gather your local ip:

Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript, so you can now obtain a users local and public IP addresses in javascript.

Source: https://github.com/vitalets/webrtc-ips
PoC: https://vitalets.github.io/webrtc-ips/demo/

08/2019 update: Currently PoC don't fully works because Chrome added mDNS support to increase anonymity.