the OWASP Broken Web Applications project (owaspbwa) is worth mentioning in this context. It&#x27;s a collection of vulnerable web applications for web security training, demonstrations and testing. It can be downloaded as a VM from [1]. I don&#x27;t have a lot of faith in sourceforge, but it seems to be the official source.<p>[1]: <a href="http:&#x2F;&#x2F;sourceforge.net&#x2F;projects&#x2F;owaspbwa&#x2F;files&#x2F;1.2&#x2F;" rel="nofollow">http:&#x2F;&#x2F;sourceforge.net&#x2F;projects&#x2F;owaspbwa&#x2F;files&#x2F;1.2&#x2F;</a>