CloudGoat
Deploy vulnerable AWS setups in your own account and hack them for flags
CloudGoat is a command-line tool that builds deliberately vulnerable cloud environments in your own AWS account. You run a command to create a scenario, get a starting set of credentials or a web address, then explore and exploit misconfigurations until you reach the goal, which is usually a flag or a secret. When you finish, another command tears it all down.
Free · No login · Terminal · Intermediate
About CloudGoat
The repo lists 25 AWS scenarios rated easy, medium or hard, covering IAM privilege escalation, SSRF, Lambda, ECS, Cognito and RDS snapshots, plus a newer Azure scenario. Each one has a walkthrough and cheat sheets if you get stuck. It trains real cloud attack paths with the AWS CLI.
It is free and open source. You need Linux or macOS, Python, Terraform and your own AWS account, so running scenarios may cost a little in cloud usage.
Made this game? Claim it →
Tips and discussion
No tips yet.
Sign in to share a tip.