BadZure deploys intentionally misconfigured Entra ID tenants and Azure subscriptions so security teams can explore, exploit, and detect cloud attack paths in a real environment. It uses Terraform to populate a tenant with users, groups, applications, and Azure resources, then layers deliberate misconfigurations on top to produce complete privilege-escalation paths that span the identity and infrastructure planes.
Every attack path begins at a compromised foothold and ends at a high-privilege target. BadZure provides the foothold credentials, so you start post-compromise and focus on the escalation itself.
📖 Full documentation: www.badzure.com
You might be one of these, or several:
- 🗡️ Red teamers: rehearse Entra ID and Azure tradecraft in a safe, disposable tenant.
- 🎯 Detection engineers & threat hunters: generate attack telemetry to build and validate detections.
- 🟣 Purple teams: reproduce a specific technique end to end and watch it from both sides.
- 🔬 Security researchers: explore cloud attack primitives and discover new ones.
- 🎓 Trainers & CTF authors: run practical cloud security labs and capture the flag challenges.
BadZure provides two ways to author an attack path: atomic (one named technique template from a catalog of seven) and chained (an explicit graph built from lower-level primitives). A chained path can reproduce one catalog behavior or combine several into a custom route. The seven atomic templates span the identity plane (ApplicationOwnershipAbuse, ApplicationAdministratorAbuse, CloudAppAdministratorAbuse) and the resource plane (ManagedIdentityAbuse, KeyVaultSecretTheft, StorageCertificateTheft, CosmosDBSecretTheft). See the technique catalog for details and interactive graphs of each.
- Azure CLI and Terraform
- An Azure subscription with an Entra ID tenant. Creating one provides both. Azure compute resources incur standard charges until you
destroythe lab.
git clone https://github.com/mvelazc0/BadZure
cd BadZure
python -m venv venv && source venv/bin/activate # Windows: venv\Scripts\activate
pip install -r requirements.txt
# Deploying requires Global Administrator in Entra ID and Owner on the subscription.
az login
python BadZure.py check --config badzure.yml # prove attack paths reachable (offline)
python BadZure.py report --config badzure.yml # render interactive graphs (offline)
python BadZure.py build --config badzure.yml # deploy the lab
python BadZure.py show # inspect what was created
python BadZure.py destroy --verbose # tear it all downSee Installation and Your First Lab for the full walkthrough, and the Configuration reference for every option.
- Mauricio Velazco, @mvelazco
- Cloud Katana by Roberto Rodriguez
- AADInternals by Nestori Syynimaa
- Azure Attack Paths by Fabian Bader
- ROADtools by Dirkjan Mollema
- PurpleCloud by Jason Ostrom
- Azure AD Attack and Defense Playbook by Sami Lamppu and Thomas Naunheim
- BloodHound/AzureHound by Andy Robbins
This project is licensed under the Apache 2.0 License. See the LICENSE file for details.