This question already has an answer here:

I'm new to both web development and security, and I was wondering whether there is some kind of reference web application that doesn't follow any of the security best practices. Something like a "Security hello world" :).

On OWASP's site there are code examples for almost every threat, I was wondering whether there is an application that would put them all together.

I would like to use it to both test my knowledge while trying to find the flaws, and to run and understand ESAPI with it.

Meanwhile a colleague of mine pointed me to OWASP's complete (and up-to-date) list of deliberately vulnerable web applications. There's so many of them, I really have to work on my googling aptitudes...

marked as duplicate by Sjoerd, Anders, Purefan, Community Feb 27 '17 at 9:04

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Add Troy Hunt's hackyourself first to that list, you don't get code but there are 50 or so vulnerabilities to find in his test public website. – iainpb Feb 27 '17 at 9:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.