the OWASP Broken Web Applications project (owaspbwa) is worth mentioning in this context. It's a collection of vulnerable web applications for web security trai

the OWASP Broken Web Applications project (owaspbwa) is worth mentioning in this context. It's a collection of vulnerable web applications for web security training, demonstrations and testing. It can be downloaded as a VM from [1]. I don't have a lot of faith in sourceforge, but it seems to be the official source. [1]: http://sourceforge.net/projects/owaspbwa/files/1.2/ http://sourceforge.net/projects/owaspbwa/files/1.2/