Welcome to the AD-Hacker-Lab

Building the ultimate Attack Defend playground for ethical hackers.

If you want to understand how threat actors move laterally through enterprise networks or exploit web vulnerabilities, you can't just read about it—you have to build it, break it, and then figure out how to patch it.

That is exactly why I built the AD-Hacker-Lab.

What is the AD-Hacker-Lab?

This repository is an automated, infrastructure-as-code (IaC) deployment of a comprehensive Attack Defend environment. It is designed specifically for penetration testers, security researchers, and QA engineers who want to practice "Break Your Baby" methodologies in a safe, sandboxed lab.

Core Targets Include:

  • WebGoat: A deliberately insecure web application maintained by OWASP, perfect for testing common web vulnerabilities (XSS, SQLi, CSRF).
  • Metasploitable2: An intentionally vulnerable Linux virtual machine designed for testing security tools and practicing common network exploits.
  • GOAD (Game of Active Directory): A complete, multi-domain Active Directory lab environment designed to practice advanced attacks (Kerberoasting, AS-REP Roasting, SMB Relay) on a realistic Windows network.

Why Open Source It?

At 303labs, our motto is: > Stop hacking each other & hack the planet instead.

By open-sourcing this lab, we are giving the community the tools to understand enterprise vulnerabilities. You can't secure the decentralized networks of our SolarPunk future if you don't intimately understand the vulnerable systems of the present.

Get Involved & Contribute

This lab is a community effort, and I am always looking for other hackers and defenders to collaborate with. If you want to get involved, there are several ways you can help:

  • Design CTFs: Have a great idea for a capture-the-flag scenario? Fork the repo and submit a pull request!
  • Solve Open Issues: Check out the issue tracker on GitHub and help us patch lab deployment bugs or improve the IaC scripts.
  • Add New Targets: Help us integrate new vulnerable applications or expand the GOAD environment.

How to Get Started

  1. Follow the setup instructions in the README to provision your vulnerable targets.
  2. Start hacking (ethically, of course).

Clone the repository:

git clone https://github.com/razor303Jc/AD-hacker-lab.git

Drop a star on the repo if you find it useful, and let me know on Twitter/X what vulnerabilities you manage to exploit!