Commando-X/vuln-bank

Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

WebGoat is a deliberately insecure application

OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

Damn Vulnerable Web Application (DVWA)

completely ridiculous API (crAPI)

Vulnerable REST API with OWASP top 10 vulnerabilities for security testing