Microsoft has released Dusseldorf, an open-source platform for out-of-band application security testing (OAST) that provides researchers with ready-made infrastructure for detecting a class of vulnerabilities that often go unnoticed. The tool addresses the challenge of identifying security flaws where applications make silent external network connections during exploitation attempts.
Out-of-band vulnerabilities occur when an application communicates with external systems as part of an attack vector, often bypassing traditional security monitoring. These vulnerabilities are difficult to detect because the malicious activity does not produce visible responses in the application itself. Until now, security researchers typically had to build their own infrastructure to capture and analyze this external traffic.
Dusseldorf captures inbound network traffic across multiple protocols, providing a centralized platform for monitoring these out-of-band connections. The platform includes functionality for crafting automated responses, enabling researchers to validate suspected vulnerabilities through controlled interaction workflows. This automation capability streamlines the testing process and reduces the manual effort required to confirm security issues.
The platform is designed to run within private environments, giving organizations control over their testing infrastructure and data. This deployment model addresses privacy and compliance concerns that might arise from using external OAST services. Security teams can now conduct out-of-band testing without routing sensitive traffic through third-party systems.
Security researchers and penetration testers should evaluate Dusseldorf for integration into their testing workflows, particularly when assessing applications for blind injection vulnerabilities, server-side request forgery, and similar attack vectors that rely on out-of-band communication. The open-source nature of the project allows teams to customize the platform for specific testing requirements and audit the code for security assurance.
Source: https://www.helpnetsecurity.com/2026/07/20/microsoft-dusseldorf-out-of-band-application-security-testing-oast-platform/