GOAD is a pentest Active Directory lab project that provides vulnerable Windows environments for practicing attack techniques.
The tool addresses the need for realistic Active Directory infrastructure to train on without risk to production systems. It uses infrastructure-as-code approaches with Terraform and Vagrant to provision virtual machines, combined with Ansible and PowerShell for configuration. The lab intentionally includes common misconfigurations and security weaknesses found in real Active Directory deployments, allowing pentesters to practice reconnaissance, lateral movement, privilege escalation, and other standard attack chains in a controlled setting.
Adoption suits pentesters and security professionals who need hands-on practice with Active Directory exploitation. The project offers multiple lab variants scaled to different hardware constraints: a full lab with multiple forests and domains, a lighter version for resource-limited machines, a minimal two-VM setup, and specialized labs featuring Microsoft Configuration Manager or challenge scenarios without provided network diagrams. This flexibility means you can choose a configuration matching your available compute resources and learning goals. The tool is explicitly designed for pentest practice and should not be used as a template for production environments due to its intentionally vulnerable configuration.
The project maintains active development with regular updates to lab configurations and documentation. The codebase shows ongoing refinement of deployment automation and lab scenarios. Community contributions indicate sustained engagement with the pentest training use case. Documentation is comprehensive and regularly maintained to support users deploying and working through the various lab configurations.
