https://github.com/ine-labs/AWSGoat
AWSGoat : A Damn Vulnerable AWS Infrastructure
https://github.com/ine-labs/AWSGoat
Last synced: about 1 month ago
JSON representation
AWSGoat : A Damn Vulnerable AWS Infrastructure
- Host: GitHub
- URL: https://github.com/ine-labs/AWSGoat
- Owner: ine-labs
- License: mit
- Created: 2022-07-13T09:59:20.000Z (almost 3 years ago)
- Default Branch: master
- Last Pushed: 2025-02-04T12:28:39.000Z (4 months ago)
- Last Synced: 2025-04-10T20:54:37.426Z (about 1 month ago)
- Language: PHP
- Size: 32.7 MB
- Stars: 1,829
- Watchers: 35
- Forks: 1,252
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-cloud-security - AWSGoat
- Awesome-CloudSec-Labs - AWSGoat - hosted, attack and defense manuals | Multiple, ine-labs | Bring your own aws account, Build with terraform, two modules, provides attack and defense manuals | (Sorted by Technology and Category)
- awesome-vulnerable-apps - AWSGoat - A Damn Vulnerable AWS Infrastructure (Cloud Security)
- awesome-php-cn - AWSGoat - AWSGoat是AWS上的一个设计脆弱的基础设施. (目录 / 无服务器的 Serverless)
- awesome-cloud-security - 地址 - labs/AWSGoat) (0x03 靶场 :dart: / 云服务靶场)
- awesome-hacking-lists - ine-labs/AWSGoat - AWSGoat : A Damn Vulnerable AWS Infrastructure (PHP)
- awesome-cyber-range-list - AWSGoat
- awesome-cyber-range-list - AWSGoat
README
# AWSGoat : A Damn Vulnerable AWS Infrastructure
Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since the cloud is relatively new, many developers are not fully aware of the threatscape and they end up deploying a vulnerable cloud infrastructure.
AWSGoat is a vulnerable by design infrastructure on AWS featuring the latest released OWASP Top 10 web application security risks (2021) and other misconfiguration based on services such as IAM, S3, API Gateway, Lambda, EC2, and ECS. AWSGoat mimics real-world infrastructure but with added vulnerabilities. It features multiple escalation paths and is focused on a black-box approach.
AWSGoat uses IaC (Terraform) to deploy the vulnerable cloud infrastructure on the user's AWS account. This gives the user complete control over code, infrastructure, and environment. Using AWSGoat, the user can learn/practice:
- Cloud Pentesting/Red-teaming
- Auditing IaC
- Secure Coding
- Detection and mitigation
The project will be divided into modules and each module will be a separate web application, powered by varied tech stacks and development practices. It will leverage IaC through terraform and GitHub actions to ease the deployment process.
**Presented at**
- [OWASP Singapore Chapter](https://owasp.org/www-chapter-singapore/)
- [BlackHat USA 2022](https://www.blackhat.com/us-22/arsenal/schedule/index.html#awsgoat--a-damn-vulnerable-aws-infrastructure-27999)
- [DC 30: Demo Labs](https://forum.defcon.org/node/242059)
- [Rootcon 16](https://rootcon.org/)
- [BlackHat ASIA 2023](https://www.blackhat.com/asia-23/arsenal/schedule/#awsgoat--a-damn-vulnerable-aws-infrastructure-31311)
### Developed with :heart: by [INE](https://ine.com/)
[
](https://discord.gg/TG7bpETgbg)
## Built With
* AWS
* React
* Python 3
* Terraform
* PHP
* Docker
## Vulnerabilities
The project is scheduled to encompass all significant vulnerabilities including the OWASP TOP 10 2021, and popular cloud misconfigurations.
Currently, the project contains the following vulnerabilities/misconfigurations.
* XSS
* SQL Injection
* Insecure Direct Object Reference
* Server Side Request Forgery on Lambda Environment
* Sensitive Data Exposure and Password Reset
* S3 Misconfigurations
* IAM Privilege Escalations
* ECS Container Breakout
# Getting Started
### Prerequisites
* An AWS Account
* AWS Access Key with Administrative Privileges
* OR use the IAM policy in the [policy.json](policy/policy.json) file for the minimum permissions required for an AWS Access Key.
### Installation
To ease the deployment process the user just needs to fork this repo, add their AWS Account Credentials to GitHub secrets, and run the Terraform Apply Action. This workflow will deploy the whole infrastructure and output the hosted application's URL.
Here are the steps to follow:
**Step 1.** Fork the repo
**Step 2.** Set the GitHub Action Secrets:
```
AWS_ACCESS_KEY
AWS_SECRET_ACCESS_KEY
```
**Step 3.** From the repository actions tab, select the module to deploy and run the ``Terraform Apply`` Workflow.
**Step 4.** Find the application URL in the Terraform output section.
### Manual Installation
Manually installing AWSGoat would require you to follow these steps:
(Note: This requires a Linux Machine, with the /bin/bash shell available)
**Step 1.** Clone the repo
```sh
git clone https://github.com/ine-labs/AWSGoat
```
**Step 2.** Configure AWS User Account Credentials
```sh
aws configure
```
**Step 3.** Traverse into the respective modules' directory and use terraform to deploy AWSGoat
```sh
cd modules/module-
terraform init
terraform apply --auto-approve
```
# Modules
## Module 1
The first module features a serverless blog application utilizing AWS Lambda, S3, API Gateway, and DynamoDB. It consists of various web application vulnerabilities and facilitates exploitation of misconfigured AWS resources.
Escalation Path:
## Module 2
The second module features an internal HR Payroll application, utilizing the AWS ECS infrastructure. It consists of various web application vulnerabilities and facilitates exploitation of misconfigured AWS resources.
Escalation Path:
**Recommended Browser:** Google Chrome
# Pricing
The resources created with the deployment of AWSGoat will not incur any charges if the AWS account is under the free tier/trial period. However, upon exhaustion/ineligibility of the free tier/trial, the following charges will apply for the US-East region:
Module 1: **$0.0125/hour**
Module 2: **$0.0505/hour**
# Contributors
Jeswin Mathai, Chief Architect, Lab Platform, INE
Nishant Sharma, Director, Lab Platform, INE
Sanjeev Mahunta, Software Engineer (Cloud), INE
Shantanu Kale, Cloud Developer, INE
Govind Krishna Lal Balaji, Cloud Developer, INE
Litesh Ghute, Software Engineer, INE
# Solutions
The offensive manuals are available in the [attack-manuals](attack-manuals/) directory, and the defensive manuals are available in the [defence-manuals](defence-manuals/) directory.
Module 1 Exploitation Videos:
[](https://www.youtube.com/playlist?list=PLcIpBb4raSZEMosUmY8KpxPWtjKRMSmNx)
# Documentation
For more details refer to the "AWSGoat.pdf" PDF file. This file contains the slide deck used for presentations.
# Screenshots
Module 1:
Module 2:
## Contribution Guidelines
* Contributions in the form of code improvements, module updates, feature improvements, and any general suggestions are welcome.
* Improvements to the functionalities of the current modules are also welcome.
* The source code for each module can be found in ``modules/module-/src`` this can be used to modify the existing application code.
# License
This program is free software: you can redistribute it and/or modify it under the terms of the MIT License.
You should have received a copy of the MIT License along with this program. If not, see https://opensource.org/licenses/MIT.
# Sister Projects
- [AzureGoat](https://github.com/ine-labs/AzureGoat)
- [GCPGoat](https://github.com/ine-labs/GCPGoat)
- [PA Toolkit (Pentester Academy Wireshark Toolkit)](https://github.com/pentesteracademy/patoolkit)
- [ReconPal: Leveraging NLP for Infosec](https://github.com/pentesteracademy/reconpal)
- [VoIPShark: Open Source VoIP Analysis Platform](https://github.com/pentesteracademy/voipshark)
- [BLEMystique](https://github.com/pentesteracademy/blemystique)