Another popular form of tunneling is via DNS requests. Those are more difficult to block/filter than ICMP. Still requires root, though.
Edit: Websockets do not support listening sockets; the connection has to be always initiated from the script side. However, the WebRTC spec should allow for peer-to-peer connections; maybe this could be leveraged somehow, too?