I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average developer. My problem is, that my knowledge is heavily focused on the theoretical part of web security - meaning, I've read lots of books, I follow blogs and mailing lists, but my practical experience is limited.

I know the root cause to vulnerabilities, I know how they work and how to stop them. What I'd like to do, is to take my knowledge to the next step - I want that practical experience. I know that I'll probably end up doing security related stuff at some point in my career, but not just yet - at least not full time. Meanwhile I'd like to build up my knowledge of web application security and get more experience, especially in fields such as penetration testing.

My question to you, my dear security experts, what advice do you have for me to get that practical experience I so desire? What resources could you recommend for learning about the different tools and techniques used in penetration testing?

One option could be, to install a vulnerable web application locally (I know there is at least one on google code, can't remember its name), and then use guides such as OWASP's Testing Guide to try out the different techniques. However, I'm probably looking for a more guided way of learning, meaning, I want to know in which order I should do stuff, make sure I'm doing stuff in the right way and in the right order - baby steps, so to say.

Any and all advice is more than welcome.