SecurityCipher
Home Blog About Us
Resources β–Ό
βœ… Security Checklists Hub πŸ—ΊοΈ Penetration Testing Roadmap πŸ€– OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist πŸ› οΈ Security Tools 🎯 Penetration Testing Tricks πŸ“„ Secure Code Explain πŸ“– Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Our ServicesServices
New On-Call Drive Drive the neon city, jack in, and clear security tickets Play now β†’
← Security Tools View on GitHub

GOAD

Game of Active Directory - lab environment for practicing AD attacks.

GOAD (Game Of Active Directory)


GOAD (v3)

πŸ”– Documentation : https://orange-cyberdefense.github.io/GOAD/

Description

GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques.

[!CAUTION] This lab is extremely vulnerable, do not reuse recipe to build your environment and do not deploy this environment on internet without isolation (this is a recommendation, use it as your own risk).
This repository was build for pentest practice.

goad_screenshot

Licenses

This lab use free Windows VM only (180 days). After that delay enter a license on each server or rebuild all the lab (may be it's time for an update ;))

Available labs

  • GOAD Lab family and extensions overview
GOAD
  • GOAD : 5 vms, 2 forests, 3 domains (full goad lab)
GOAD
  • GOAD-Light : 3 vms, 1 forest, 2 domains (smaller goad lab for those with a smaller pc)
GOAD Light
  • MINILAB: 2 vms, 1 forest, 1 domain (basic lab with one DC (windows server 2019) and one Workstation (windows 10))

  • SCCM : 4 vms, 1 forest, 1 domain, with microsoft configuration manager installed

SCCM
  • NHA : A challenge with 5 vms and 2 domains. no schema provided, you will have to find out how break it.
SCCM
  • DRACARYS : A challenge with 3 vms and 1 domains. no schema provided, you will have to find out how break it.
SCCM

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Product Security Engineer || AI Security

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • Cloud Misconfig Bounty Hunting in 2026: Open Buckets, Firebase, and Secrets
    Cloud Misconfig Bounty Hunting in 2026: Open Buckets, Firebase, and Secrets
    September 8, 2026/
    0 Comments
  • DevSecOps From Laptop to Production: A Practical Security Pipeline Guide
    DevSecOps From Laptop to Production: A Practical Security Pipeline Guide
    August 27, 2026/
    0 Comments
  • The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    August 25, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Security Checklists
  • Cybersecurity Jobs
  • Blogs
  • About
  • Contact
Β© 2026 SecurityCipher. All rights reserved. Privacy Policies Β· Terms & Conditions