https://github.com/XMCyber/XMGoat

https://github.com/XMCyber/XMGoat

Last synced: 3 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/XMCyber/XMGoat
• Owner: XMCyber
• Created: 2021-11-11T12:32:12.000Z (almost 3 years ago)
• Default Branch: main
• Last Pushed: 2023-04-22T00:52:20.000Z (over 1 year ago)
• Last Synced: 2024-06-16T11:33:22.879Z (5 months ago)
• Language: HCL
• Size: 274 KB
• Stars: 155
• Watchers: 8
• Forks: 27
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• Awesome-CloudSec-Labs - XMGoat - hosted, guided labs | Multiple | Build with terraform, 5 scenarios, solution docs provided | (Sorted by Technology and Category)

README

        
# XMGoat 



## Overview

XM Goat is composed of XM Cyber terraform templates that help you learn about common Azure security issues. Each template is a vulnerable environment, with some significant misconfigurations. Your job is to attack and compromise the environments.

Here’s what to do for each environment:

1. Run installation and then get started.

2. With the initial user and service principal credentials, attack the environment based on the scenario flow (for example, XMGoat/scenarios/scenario_1/scenario1_flow.png).

3. If you need help with your attack, refer to the solution (for example, XMGoat/scenarios/scenario_1/solution.md).

4. When you’re done learning the attack, clean up.

## Requirements

* Azure tenant

* Terafform version 1.0.9 or above

* Azure CLI

* Azure User with Owner permissions on Subscription and Global Admin privileges in AAD

## Installation

Run these commands:

```

$ az login

$ git clone https://github.com/XMCyber/XMGoat.git

$ cd XMGoat

$ cd scenarios

$ cd scenario_<\SCENARIO>

```

Where <\SCENARIO> is the scenario number you want to complete

```

$ terraform init

$ terraform plan -out <\FILENAME>

$ terraform apply <\FILENAME>

```

Where <\FILENAME> is the name of the output file

## Get started

To get the initial user and service principal credentials, run the following query:

```

$ terraform output --json

```

For Service Principals, use application_id.value and application_secret.value.

For Users, use username.value and password.value.

## Cleaning up

After completing the scenario, run the following command in order to clean all the resources created in your tenant

```

$ az login

$ cd XMGoat

$ cd scenarios

$ cd scenario_<\SCENARIO>

```

Where <\SCENARIO> is the scenario number you want to complete

```

$ terraform destroy

```