

WebGoat – A deliberately insecure JavaEE application - gkop
https://webgoat.github.io/

======
splitdisk
Very fun to practice various cross-scripting and injection techniques on!

