◆ Vulnerable targets & payloads

Kubernetes Goat

MIT

A vulnerable-by-design Kubernetes cluster environment with guided scenarios, for testing container and Kubernetes security products.

source ↗ ★ 5,773 last push 2026-04-16

Summary

Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀

from the project README

From the project’s own instructions where it documents any; otherwise a plain clone.

shell

$ git clone https://github.com/madhuakula/kubernetes-goat.git

shell
```
$ cd kubernetes-goat && bash setup-kubernetes-goat.sh
```
Against a throwaway cluster (kind or similar) — it deploys deliberately vulnerable workloads.
shell
```
$ bash access-kubernetes-goat.sh
```
Once `kubectl get pods` shows everything running.

379 files 127.2 MB repository

Commands are curated, not yet run by us.

nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).

sample.app

$ nuclei -u http://127.0.0.1:3000

OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.

sample.app

$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000