Microsoft Releases Dusseldorf, Open-Source Platform for Out-of-Band Security Testing
Microsoft has launched Dusseldorf, an open-source platform designed to simplify the testing of out-of-band vulnerabilities by capturing and analyzing inbound network traffic.
Microsoft has introduced Dusseldorf, a new open-source platform aimed at streamlining the process of testing for out-of-band (OAST) vulnerabilities. These types of vulnerabilities occur when an application communicates with external systems during an attack, often leaving subtle traces that are difficult to capture with traditional security testing methods. Dusseldorf provides the necessary infrastructure to intercept this outbound traffic, allowing security researchers and developers to more effectively identify and validate these elusive flaws.
The platform is designed to capture inbound network traffic across multiple protocols, enabling operators to craft automated responses for validation workflows. The name 'Dusseldorf' is a nod to Microsoft's internal project naming conventions, playfully incorporating the letters 'SSRF' from "Server-Side Request Forgery," a common OAST vulnerability, within the city's name. This tool specifically targets a range of defects that are hard to detect within an application's internal logs, including Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), Server-Side Template Injection (SSTI), and XML External Entity (XXE) flaws, among others. Its effectiveness lies in its ability to monitor an application's network edge, where these external communications occur.
Once deployed, Dusseldorf establishes listeners for DNS, HTTP, and HTTPS protocols tied to a designated domain, such as *.yourdomain.net. Any request directed to this domain or its subdomains is logged and can be analyzed. The platform offers a secure graphical interface and a REST API, providing operators with a clear view of captured requests and responses. These interfaces also grant control over custom responses and filtering mechanisms, allowing for tailored testing scenarios.
A core design principle of Dusseldorf is private deployment, giving operators complete control over identity integration, infrastructure footprint, the domains in use, and runtime policies governing traffic handling. Administrators can adjust rules and service-level configurations to dictate how the platform responds to incoming traffic, ensuring it aligns with specific security testing requirements and environments.
To run Dusseldorf, an internet-facing machine with public IP addresses and a domain name pointing to those addresses is required. The codebase is built with Azure integration in mind, offering two distinct deployment paths. A local path is suitable for lab setups and developer iteration, featuring workflows for credential generation, certificate setup, and Docker Compose. For cloud environments, an Azure path facilitates cloud provisioning and database initialization using Helm charts.
The prerequisites for installation reflect this dual deployment approach, including Docker, Docker Compose, the Azure CLI, OpenSSL for TLS certificates, Python 3 with pip, the jq utility, and Helm. After deployment, operators can manage the platform through its web interface and API, with comprehensive documentation also available for command-line operations.
Dusseldorf is freely available on GitHub, encouraging widespread adoption and contribution from the cybersecurity community. Its release signifies Microsoft's commitment to fostering open-source security tools and empowering developers to build more secure applications by simplifying the testing of complex vulnerability classes.