Microsoft Dusseldorf Brings Open-Source OAST to Your Servers

Microsoft Open-Sources a Self-Hosted OAST Platform

On July 20, 2026, Microsoft released Dusseldorf, a free and open-source out-of-band application security testing platform, on GitHub at github.com/microsoft/dusseldorf. For internal AppSec teams and security researchers, it answers a question that has nagged at the discipline for years: where should your callback data actually live? Dusseldorf's answer is refreshingly simple - on infrastructure you own.

• Released July 20, 2026 as free and open-source software at github.com/microsoft/dusseldorf
• Runs your own DNS, HTTP, and HTTPS listeners bound to a wildcard domain such as *.yourdomain.net
• Detects and validates SSRF, blind XSS, SSTI, and XXE - bug classes that produce no visible in-band response
• Two deployment paths ship: Docker Compose for lab work, and a Helm-based Azure deployment with database initialization

What Is OAST, in Plain Terms?

Most security testing is a conversation: you send a request, you read the response, you learn something. Out-of-band application security testing exists for the bugs that never answer you directly. A vulnerable server might quietly reach out to an address you specified, or a script might fire hours later in an administrator's browser, and nothing in the original response hints that anything happened at all.

OAST catches those cases by giving the vulnerable system somewhere to phone home to. You stand up a listener on a domain you control, and if a request ever arrives at that domain, you have proof the behavior is real. It is less an attack technique than a smoke detector: silent until something is genuinely wrong, then unambiguous.

How Dusseldorf Works

Dusseldorf gives you the listener infrastructure as a package. You bind DNS, HTTP, and HTTPS listeners to a wildcard domain, and every request to that domain or any subdomain is written to a capture log. That log becomes your evidence trail when you are confirming which of your own services can be induced into making unintended outbound requests.

From there it adds workflow. Operators can craft automated, rule-based responses to inbound requests, which turns a passive log into an active validation pipeline - useful when you need to distinguish a genuine finding from a noisy scanner. The system is driveable three ways: a protected web UI, a matching REST API, and CLI tooling, so it slots into a pipeline as comfortably as it sits on an analyst's screen.

And yes, the name is a joke worth appreciating. Dusseldorf is a German city whose letters happen to contain SSRF.

Why Does Self-Hosting Callback Data Matter So Much?

This is the headline for defenders. Callback data is some of the most sensitive output any security test produces. When an internal service reaches out to your listener, the request frequently carries internal hostnames, service names, cloud metadata, and sometimes tokens. That is a map of your estate, generated by your own testing.

Public callback services are convenient, but that data leaves your boundary by design. Because Dusseldorf is privately deployed, the capture log never departs your own infrastructure. Regulated teams get to run out-of-band testing without adding a third-party data-handling question to every engagement - the same data-sovereignty logic that has driven so much of the open-source AI security tooling wave over the past year.

Which Bug Classes Does It Help You Fix?

Four, primarily, and all of them are worth hunting in your own systems:

| Class | What it means for your estate |

| --- | --- |

| SSRF | An internal service can be steered into making outbound requests on someone else's behalf |

| Blind XSS | Script executes somewhere you cannot see, often in an admin view |

| SSTI | Template input is evaluated rather than escaped |

| XXE | An XML parser resolves external entities it should ignore |

Each is quiet by nature, which is exactly why a durable capture log is the right tool. Confirming and closing these is the same disciplined, evidence-first posture behind well-run coordinated disclosure work like the 7-Zip 26.02 update.

Getting Started

The Docker Compose path is the gentle on-ramp for a local lab. The Azure route uses Helm with database initialization and expects Docker, Docker Compose, the Azure CLI, OpenSSL, Python 3 with pip, jq, and Helm in place. Pick a domain you genuinely control, start with Compose, and graduate once the workflow fits your team. More defender-first tooling coverage lives on our AI security hub.

Sources: Help Net Security - July 20, 2026; Microsoft on GitHub - July 2026.