Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Getting Started with EntraGoat: Breaking Entra ID the Smart Way

semperis.com | blog | #ctf | #security-training | #entra-id | #tutorial | #semperis | #entragoat

Summary

A quick-start guide to EntraGoat: test tenant, Node.js and PowerShell 7 prerequisites, cloning the lab, launching your first challenge, capturing flags and cleaning up afterwards.
Published
Collected

original ↗

Related coverage

blog · semperis.com
What Is EntraGoat? A Deliberately Vulnerable Entra ID Simulation Environment
Introducing EntraGoat: an open-source, deliberately vulnerable Entra ID lab that reproduces real-world misconfigurations in CTF form so identity defenders can safely practice attack paths.
blog · semperis.com
EntraGoat Scenario 2: Exploiting App-Only Graph Permissions in Entra ID
EntraGoat Scenario 2: a certificate leaked through CI/CD artifacts leads to app-only Graph permission abuse — self-assigning RoleManagement.ReadWrite.Directory and resetting the Global Admin password.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a CTF Security Challenge for the Blockchain Industry
HackenProof and Hack The Box turn blockchain security into a gamified CTF track with weekly challenges and a ten-quest series, giving top performers a path into the bug bounty ecosystem.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a Course for the Blockchain Industry
HackenProof has launched a blockchain-industry course with Hack The Box, the four-million-member ethical hacking platform, aimed at building practical blockchain security skills.
blog · wiz.io
Introducing the Prompt Airlines CTF: Test Your AI Security Skills
Wiz launched Prompt Airlines, a chatbot-based CTF where players exploit AI logic flaws to win a free flight ticket, teaching real LLM security risks; open to all skill levels.
research · semperis.com
EntraGoat Scenario 3: Exploiting Group Ownership in Entra ID
EntraGoat Scenario 3: how group ownership, role-assignable groups and service principal management chain from a low-privileged user to Global Administrator — plus detection and defense guidance.
back