Well JS can make GET and POST requests to arbitrary URLs, that is often enough for a DDoS.