# XMGoat | Composed of XM Cyber terraform templates that help you learn about common Azure security issues

**URL:** <https://onehack.st/t/xmgoat-composed-of-xm-cyber-terraform-templates-that-help-you-learn-about-common-azure-security-issues/285131>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [June 23, 2024, 7:56pm UTC](https://onehack.st/t/xmgoat-composed-of-xm-cyber-terraform-templates-that-help-you-learn-about-common-azure-security-issues/285131 "2024-06-23T19:56:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [June 23, 2024, 7:56pm UTC](https://onehack.st/t/xmgoat-composed-of-xm-cyber-terraform-templates-that-help-you-learn-about-common-azure-security-issues/285131/1 "2024-06-23T19:56:00Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/b/9b824f42e519f8624f043fd111c6eb28935cef5b.png)

## Overview

XM Goat is composed of XM Cyber terraform templates that help you learn about common Azure security issues. Each template is a vulnerable environment, with some significant misconfigurations. Your job is to attack and compromise the environments.

Here’s what to do for each environment:

1. Run installation and then get started.
2. With the initial user and service principal credentials, attack the environment based on the scenario flow (for example, XMGoat/scenarios/scenario\_1/scenario1\_flow.png).
3. If you need help with your attack, refer to the solution (for example, XMGoat/scenarios/scenario\_1/solution.md).
4. When you’re done learning the attack, clean up.

## Requirements

- Azure tenant
- Terafform version 1.0.9 or above
- Azure CLI
- Azure User with Owner permissions on Subscription and Global Admin privileges in AAD

## Installation

Run these commands:

```auto
$ az login
$ git clone https://github.com/XMCyber/XMGoat.git
$ cd XMGoat
$ cd scenarios
$ cd scenario_<\SCENARIO>

```

Where \<\SCENARIO\> is the scenario number you want to complete

```auto
$ terraform init
$ terraform plan -out <\FILENAME>
$ terraform apply <\FILENAME>

```

Where \<\FILENAME\> is the name of the output file

## Get started

To get the initial user and service principal credentials, run the following query:

```auto
$ terraform output --json

```

For Service Principals, use application\_id.value and application\_secret.value.

For Users, use username.value and password.value.

## Cleaning up

After completing the scenario, run the following command in order to clean all the resources created in your tenant

```auto
$ az login
$ cd XMGoat
$ cd scenarios
$ cd scenario_<\SCENARIO>

```

Where \<\SCENARIO\> is the scenario number you want to complete

```auto
$ terraform destroy

```

## GitHub:

> **[GitHub - XMCyber/XMGoat](https://github.com/XMCyber/XMGoat)**
>
> Contribute to XMCyber/XMGoat development by creating an account on GitHub.