PaaS Cloud Goat is a simulated vulnerable Salesforce application providing hands-on experience with penetration testing of custom Salesforce applications.

The tool is similar to others like CloudGoat, CloudFoxable, AzureGoat, GCPGoat, and Pen-Testing Cloud REST APIs in OpenStack. It is not, however, a tool for attacking Salesforce.com itself.

It is novel because it focuses on custom applications deployed using the Salesforce platform and is the first tool to provide lab exercises with a collection of security tests. The main takeaways:

1. Hands-on learning opportunity of pen testing custom Salesforce applications
2. Detailed training documentation material about the underlying flaws
3. Consolidated list of common Salesforce application vulnerabilities

---

Installation

See INSTALL

Getting Started

Important

Ensure that you understand and follow the Salesforce policy for any security testing: https://www.salesforce.com/company/disclosure/

1. Login to the Salesforce test environment using the "Standard User" profile
2. Use the Salesforce App Launcher menu to search for "PaaS Cloud Goat"
3. You will find in the application helpful guidance and hints for working through the various lab excercises

License

See LICENSE