◆ Vulnerable targets & payloads

Rhino Security Labs CloudGoat

BSD-3-Clause

Vulnerable-by-design AWS (and Azure) scenarios deployed with Terraform, for testing CSPM, CIEM and cloud detection products.

source ↗ ★ 3,725 last push 2026-04-28

Summary

_CloudGoat is Rhino Security Labs' "Vulnerable by Design" cloud deployment tool._

from the project README

From the project’s own instructions where it documents any; otherwise a plain clone.

shell
```
$ pipx install cloudgoat
```
Needs terraform and the AWS CLI.
shell
```
$ cloudgoat config aws
```
Scenarios deploy real vulnerable resources into the AWS account you configure — use a dedicated sandbox account.

1,954 files 16.1 MB repository

Commands are curated, not yet run by us.

nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).

sample.app

$ nuclei -u http://127.0.0.1:3000

OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.

sample.app

$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000