XMGoat To Detect Azure Security Issues


XMGoat Penetration Testing Suite To Identify Azure Security Issues

In the Azure environment, XMGoat open source software enables penetration testers, red teams, security consultants, and cloud experts to identify and exploit different misconfigurations.

XM Goat is composed of XM Cyber terraform templates that help you learn about common Azure security issues.

Each template has significant misconfigurations, making it a vulnerable environment. Your job is to compromise the environments to make them more secure.

What is Microsoft Azure Security?

Microsoft Azure is a public cloud platform that supports a wide range of operating systems, programming languages, frameworks, tools, databases, and devices.

It allows Linux containers with Docker integration, as well as creating applications using JavaScript, Python, .NET, PHP, Java, and Node.js; and building back-ends for iOS, Android, and Windows devices.

Here’s what to do for each environment:

Run installation and then get started.

With the initial user and service principal credentials, attack the environment based on the scenario flow (for example, XMGoat/scenarios/scenario_1/scenario1_flow.png).

If you need help with your attack, refer to the solution (for example, XMGoat/scenarios/scenario_1/solution.md).

When you’re done learning the attack, clean up.


  • Azure tenant
  • Terafform version 1.0.9 or above
  • Azure CLI
  • Azure User with Owner permissions on Subscription and Global Admin privileges in AAD


Run these commands:

$ az login
$ git clone https://github.com/XMCyber/XMGoat.git
$ cd XMDGoat
$ cd scenarios
$ cd scenario_<\SCENARIO>

Where <\SCENARIO> is the scenario number you want to complete

$ terraform init
$ terraform plan -out <\FILENAME>
$ terraform apply <\FILENAME>

Where <\FILENAME> is the name of the output file

Get started

To get the initial user and service principal credentials, run the following query:

$ terraform output --json

For Service Principals, use application_id.value and application_secret.value.

For Users, use username.value and password.value.

Cleaning up

After completing the scenario, run the following command in order to clean all the resources created in your tenant

$ az login
$ cd XMGoat
$ cd scenarios
$ cd scenario_<\SCENARIO>

Where <\SCENARIO> is the scenario number you want to complete

$ terraform destroy

Download XMGoatTo Identify Azure Security Issues

Join Our Club

Enter your Email address to receive notifications | Join over Million Followers

Previous Article

Bitmart Hacked - $150 Million in Cryptocurrency Stolen

Next Article
Kali Linux 2021-4

Kali Linux 2021.4 - Last Release of 2021

Related Posts