OWASP Serverless Goat

Thank you for visiting OWASP.org. We recently migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. The historical content can be found here.

Please visit our Page Migration Guide for more information about updating pages for the new website as well as examples of github markdown.

![Sgoatbanner.png](Sgoatbanner.png "Sgoatbanner.png")

OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP.

You can install ServerlessGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.

As serverless adoption is expected to continue growing and reach new audiences, we see the importance of education on topics such as how to build robust, secure and reliable AWS Lambda serverless applications. This project will expose developers and security practitioners to basic serverless security concepts, risks, attacks and mitigation best-practices.

OWASP ServerlessGoat is packaged as an AWS SAM application that's available for deployment through the AWS Serverless Application Repository - this provides three important benefits:

  • A single click installation process. No compilation, building or packaging required
  • The application uses default serverless application repository permissions (SAM policy templates), making it more realistic
  • The installation doesn't create custom IAM roles or resource policies on the account in which it is deployed in


OWASP does not take responsibility for the way in which any one uses the ServerlessGoat application. OWASP made the purposes of the application clear and it should not be used maliciously. We have given warnings and taken measures to prevent users from installing ServerlessGoat on production accounts.


The application is a service which receives a URL to a Word document (with a .doc extension - Office 97-2004), and will reply with an HTML page containing the extracted text.

The vulnerabilities that are included are:

  • Event-data injection (SAS-01)
  • Insecure Serverless Deployment Configuration (SAS-03)
  • Over-privileged function permissions & roles (SAS-04)
  • Inadequate function monitoring and logging (SAS-05)
  • Insecure 3rd Party Dependencies (SAS-06)
  • Application layer Denial of Service (SAS-08)
  • Improper exception handling and verbose error messages (SAS-10)
  • Other undisclosed *critical* issues, as a bonus!


The OWASP ServerlessGoat project is free for use. You can redistribute it and/or modify it under the terms of the link GNU Affero General Public License 3.0 as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.


ServerlessGoat is a simple AWS Lambda application, which serves as a MS-Word .doc file to plain text converter service. It receives a URL to a .doc file as input, and will return the text inside the document back to the API caller. ​ The application is packaged and published for deployment through the AWS Serverless Application Repository. ​ Steps for deployment:

  1. Make sure you are logged into your AWS account
  2. Click on the following link: AWS Serverless Application Repository
  3. Click 'Deploy'
  4. Click 'Deploy' (again)
  5. Wait until you see the message 'Your application has been deployed'
  6. Click on 'View CloudFormation Stack'
  7. Under 'Outputs' you will find the URL for the application (WebsiteURL) ​

You can find a live version of the application hosted by PureSec in the following URL: https://www.serverless-hack.me/


  • 18-December-2018: Initial release. Collect feedback from the public (done)
  • 1-January-2019: Beta release with additional features.
  • 15-January: v1.0 official launch

Project Sponsors

The project was initially developed by Ory Segal & Yuri Shapira @ PureSec:


Cheat Sheet

You can find a full walkthrough (with spoilers of course) in the LESSONS.md file in the Git repo

Getting Involved

You do not have to be a security expert or a programmer to contribute. Contact the Project Leader(s) to get involved, we welcome any type of suggestions and comments.


Project GitHub

</td> </tr> </tbody>

Project Resources

1-click installation on your own AWS account via the AWS Serverless App Repository

1-click installation on your own AWS account via the AWS Serverless App Repository

A live version of the application is hosted by PureSec at: https://www.serverless-hack.me/

A live version of the application is hosted by PureSec at: https://www.serverless-hack.me/

Project Leader

Project Leader

Ory Segal , PureSec (email)

Ory Segal , PureSec (email)

Project Mailing List

Project Mailing List



Github Repo

Github Repo

Project GitHub



Category:OWASP Project Category:OWASP Project Category:OWASP_Builders Category:OWASP_Builders Category:OWASP_Defenders Category:OWASP_Defenders Category:OWASP_Tool Category:OWASP_Tool


Put whatever you like here: news, screenshots, features, supporters, or remove this file and don’t use tabs at all.