GOAD

Judgement

What it is

Template or starter

What it does

Builds a deliberately vulnerable Windows Active Directory lab of several VMs with Vagrant, Terraform and Ansible so pentesters can practise attack techniques.

Adopt it when

You are learning or training Active Directory penetration testing and want a realistic multi-domain lab on your own hardware or cloud account.

Watch out

The lab is insecure by design and must stay isolated from real networks, and it uses 180-day Windows evaluation licences that expire.

Ready for

Usable

Runs as

Command line

Built with

PowerShell, Python, Ansible, Terraform and Vagrant

How established

Established: started 5 years ago, no tagged release yet.

What the license allows

Use inside your business is unrestricted, but anything you distribute that includes it must be released under the same license.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: GOAD → V8 → LLVM project → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to GOAD

1. 1
   Terraform hashicorp

   Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

   Developer tool Production-ready Your team provisions infrastructure across one or more cloud providers and wants it reviewed and versioned as code with the largest provider ecosystem available.

   ★ 50k See repository Go Active, pushed today
   
2. 2
   Trivy aquasecurity

   Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

   Developer tool Production-ready You want one free scanner in CI that covers container images, dependencies and infrastructure code instead of several separate tools.

   ★ 39k Apache-2.0 Go Active, pushed today
3. 3
   OpenTofu opentofu

   OpenTofu lets you declaratively manage your cloud infrastructure.

   Developer tool Production-ready You want Terraform-style infrastructure management under an open-source licence, without HashiCorp's Business Source Licence.

   ★ 31k MPL-2.0 Go Active, pushed today
   
4. 4
   Kestra kestra-io

   Orchestrate everything, everywhere. The open-source control plane for workflows across data, infrastructure, business processes and AI agents. Declarative YAML, event-driven, any language, Git-versioned, scalable to millions of executions.

   Complete system Production-ready You need Airflow-class orchestration but want YAML flows, any language, and a UI non-Python people can use.

   ★ 30k Apache-2.0 Java Active, pushed today
5. 5
   Pulumi pulumi

   Pulumi - Infrastructure as Code in any programming language 🚀

   Developer tool Production-ready Your engineers would rather write infrastructure in a general-purpose language with loops, functions and tests than learn HCL.

   ★ 26k Apache-2.0 Go Active, pushed today
6. 6
   Salt saltstack

   Software to automate the management and configuration of infrastructure and applications at scale.

   Developer tool Production-ready You manage a large fleet of servers and need fast remote execution plus configuration management with an agent on each machine.

   ★ 16k Apache-2.0 Python Active, pushed today
7. 7
   AWS CDK aws

   The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code

   Framework or platform Production-ready Everything you run is on AWS and you want typed, reusable infrastructure code that stays inside CloudFormation's deployment model.

   ★ 13k Apache-2.0 TypeScript Active, pushed today
8. 8
   Encore encoredev

   Infrastructure orchestration from local to your cloud

   Framework or platform Usable You are starting a new backend and want infrastructure derived from application code instead of writing Terraform yourself.

   ★ 13k MPL-2.0 Go Active, pushed 2 days ago