Microsoft has released an open-source security platform named Dusseldorf, designed to assist researchers and security teams in detecting out-of-band vulnerabilities. The platform, available on GitHub, provides infrastructure for capturing and analyzing network traffic that applications generate when interacting with external systems during an attack.
Out-of-band vulnerabilities are characterized by an application making discreet requests to an external system, often leaving minimal internal traces. Dusseldorf aims to detect these by monitoring network edge activity. The platform targets several classes of defects, including server-side request forgery (SSRF), cross-site scripting (XSS), server-side template injection (SSTI), and XML external entity (XXE) flaws. The name "Dusseldorf" is a nod to Microsoft's practice of using place names for projects, with the German city's name containing the letters "SSRF."
Once deployed, Dusseldorf functions as an out-of-band application security testing platform, running DNS, HTTP, and HTTPS listeners. It is configured to capture all inbound network traffic directed to a specified domain and its subdomains, such as `*.yourdomain.net`. Each unique subdomain, referred to as a "zone" (e.g., `foo.yourdomain.net` or `foo.bar.yourdomain.net`), registers as a distinct entry in the capture log.
The platform offers a protected graphical user interface and a REST API, allowing operators to view captured requests and their corresponding responses. These interfaces also provide controls for crafting custom responses and applying filters to the traffic. A key design principle of Dusseldorf is private deployment, giving operators full control over identity integration, infrastructure footprint, domain configurations, and runtime policies for handling requests.
To run Dusseldorf, a machine with one or more public IPv4 addresses and a domain whose name server records point to those addresses is required. The codebase is optimized for Azure environments and supports two deployment paths. A local path, utilizing Docker Compose workflows, is suitable for lab setups and developer iteration, handling credential generation and certificate setup. An Azure path, leveraging Helm, manages cloud provisioning and database initialization.
The prerequisites for installation reflect this dual approach, including Docker, Docker Compose, the Azure CLI, OpenSSL for TLS certificates, Python 3 with pip, the `jq` utility, and Helm. After deployment, operators can interact with the platform through its interface, API, or a documented command-line interface.
