Project Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale

on YouTube ↗39m

" summary

Project Dusseldorf is an open‑source out‑of‑band appsec platform that catches DNS/HTTP/HTTPS callbacks at cloud scale, used internally by ~130 Microsoft red and appsec teams to find SSRF, XXE, SSTI, XSS and blind RCEs. It runs Python listeners, stores events in Cosmos/MongoDB, exposes a REST API and React UI, generates virtually unlimited subdomains for noisy fuzzing and performs DNS‑first detection plus a custom response engine to provoke further egress and extract tokens. Live tenant and GitHub repo are available.

AI-written summary · about

" chapters (9)

1. 0:00Introduction and motivation
2. 1:50Why we built DLOR
3. 6:24Understanding SSRF vulnerabilities
4. 15:30What is Project DLOR
5. 19:23DLOR architecture overview
6. 21:30Zones and unlimited host names
7. 27:33How to use DLOR UI
8. 35:17Demo and access details
9. 37:43Empowering researchers

" related talks

• 58mOpen Source Pentesting and Security Analysis Tools: the DevOps wayChristian Nils Schneider · DevOpsCon Spring 2019
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 57mEnterprise Ethical Hacking Cloud ApplicationsRohit Bhardwaj · Developer Summit 2020
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 50mAvoiding cloud security anti-patterns the right wayJay Chen, Nathaniel Quist, Matt Chiodi · AWS re:Invent 2019
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 29mMapping the SaaS Attack SurfaceJaime Blasco · BSidesSF 2025