Security Cipher
Home Blog About Us
Resources β–Ό
βœ… Security Checklists Hub πŸ—ΊοΈ Penetration Testing Roadmap 🌐 Web Application Security Checklist πŸ€– OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist πŸ› οΈ Security Tools 🎯 Penetration Testing Tricks πŸ“„ Secure Code Explain πŸ“– Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Contact UsContact
← Security Tools View on GitHub

GOAD

Game of Active Directory - lab environment for practicing AD attacks.

GOAD (Game Of Active Directory)


GOAD (v3)

πŸ”– Documentation : https://orange-cyberdefense.github.io/GOAD/

Description

GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques.

[!CAUTION] This lab is extremely vulnerable, do not reuse recipe to build your environment and do not deploy this environment on internet without isolation (this is a recommendation, use it as your own risk).
This repository was build for pentest practice.

goad_screenshot

Licenses

This lab use free Windows VM only (180 days). After that delay enter a license on each server or rebuild all the lab (may be it's time for an update ;))

Available labs

  • GOAD Lab family and extensions overview
GOAD
  • GOAD : 5 vms, 2 forests, 3 domains (full goad lab)
GOAD
  • GOAD-Light : 3 vms, 1 forest, 2 domains (smaller goad lab for those with a smaller pc)
GOAD Light
  • MINILAB: 2 vms, 1 forest, 1 domain (basic lab with one DC (windows server 2019) and one Workstation (windows 10))

  • SCCM : 4 vms, 1 forest, 1 domain, with microsoft configuration manager installed

SCCM
  • NHA : A challenge with 5 vms and 2 domains. no schema provided, you will have to find out how break it.
SCCM
  • DRACARYS : A challenge with 3 vms and 1 domains. no schema provided, you will have to find out how break it.
SCCM
Press Escape to close the search panel.

Donate

Buy me a Coffee

Penetration Testing Services - Fiverr

Buy me a Coffee

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Application Security Engineer

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
    August 25, 2026/
    0 Comments
  • RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
    RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
    August 19, 2026/
    0 Comments
  • Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
    Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
    August 13, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Start Here
  • Security Checklists
  • Writeup Checklists
  • Cybersecurity Jobs
  • CVE Lookup
  • Bug Bounty Programs
  • Security Conferences
  • Payload Cheatsheets
  • Interview Prep
  • Blogs
  • About
  • Contact
  • RSS Feed

Recent Post

  • The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
  • RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
  • Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
Β© 2026 SecurityCipher. All rights reserved. Privacy Policies Β· Terms & Conditions