EntraGoat - A Deliberately Vulnerable Entra ID Environment

EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure for security professionals. Deploy real-world identity misconfigurations and privilege escalation paths in your own tenant, then practice exploiting them in a safe, black-box CTF format.

📖 Documentation  |  📝 Blog Posts

Quick Start

Prerequisites

• Microsoft Entra ID test/trial tenant with Global Administrator
• Microsoft Graph PowerShell SDK

Option A: PowerShell GUI (recommended, no Node.js)

git clone https://github.com/Semperis/EntraGoat && cd EntraGoat
Install-Module Microsoft.Graph -Scope CurrentUser -Force
.\Start-EntraGoat.ps1

Requires Windows (WPF). Works on PowerShell 5.1+ and 7+.
Zoom: Ctrl+Plus / Ctrl+Minus / Ctrl+0

Option B: Web UI

git clone https://github.com/Semperis/EntraGoat && cd EntraGoat
Install-Module Microsoft.Graph -Scope CurrentUser -Force
cd frontend && npm install && npm start

Open http://localhost:3000

Option C: Manual scripts

cd scenarios
.\EntraGoat-Scenario1-Setup.ps1

See docs/getting-started.md for detailed setup instructions.

Challenges

Each scenario includes a setup script, cleanup script, solution walkthrough, and a hidden flag.

Screenshots

PowerShell GUI (recommended)

Home

Challenge

Terminal Output

Setup	Cleanup

Web UI (alternative)

Dashboard	Challenge

Presented at

• Black Hat USA 2025 — Arsenal
• DEF CON 33 — Demo Labs
• BSides Frankfurt 2025
• SEC-T 0x11
• Black Hat SecTor 2025 — Arsenal
• Black Hat Europe 2025 — Arsenal
• Black Hat Asia 2026 — Arsenal

Resources

• What Is EntraGoat?
• Getting Started with EntraGoat
• Scenario 1: Service Principal Ownership Abuse
• Scenario 2: Exploiting App-Only Graph Permissions
• Scenario 6: Certificate-Based Authentication Abuse

⚠️ Disclaimer

For educational and authorized testing only. Use a dedicated test tenant. See LICENSE for full terms. The authors assume no liability for misuse.

Happy Hunting! — The EntraGoat Team