Meet Dusseldorf, Microsoft’s open-source out-of-band security platform
Out-of-band vulnerabilities surface when an application quietly reaches out to an external system during an attack, and capturing that traffic calls for infrastructure that many researchers assemble on their own. A new open-source project from Microsoft supplies that infrastructure in a package meant to run inside a private environment.
Dusseldorf is an out-of-band application security testing platform. It captures inbound network traffic across several protocols and lets an operator craft automated responses for validation workflows. The name comes from a Microsoft habit of using place names for projects. The German city Düsseldorf carries the letters SSRF, and the umlaut gives way to a plain u for everyday use.
The tool targets a set of defects that leave few traces inside an application. These include server-side request forgery, cross-site scripting, server-side template injection, XML external entity flaws, and related classes. Detection depends on watching what an application does at the network edge, which is where Dusseldorf sits.
Once deployed, the platform runs DNS, HTTP, and HTTPS listeners tied to a domain such as *.yourdomain.net. Every request to that domain and any subdomain lands in the capture log. The project calls these subdomains zones, so foo.yourdomain.net and foo.bar.yourdomain.net both register as distinct entries. A protected graphical interface and a matching REST API give an operator a view of captured requests and their responses, along with controls for custom responses and filters.
Private deployment is the design premise. An operator controls identity integration, the infrastructure footprint, the domains in play, and the runtime policies that govern request handling. Rules and service-level changes adjust how the platform answers incoming traffic.
Running Dusseldorf calls for a machine on the internet with one or more public IPv4 addresses and a domain whose name server record points at those addresses. The codebase is built for Azure and splits into two deployment paths. A local path covers lab setups and developer iteration, with credential generation, certificate setup, and Docker Compose workflows. An Azure path handles cloud provisioning and database initialization through Helm.
The prerequisite list reflects that dual approach. An installer needs Docker, Docker Compose, the Azure CLI, OpenSSL for TLS certificates, Python 3 with pip, the jq utility, and Helm. After deployment, operators work through the interface and API, with a command-line path documented alongside them.
Dusseldorf is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!