Free intentionally vulnerable web app
Free intentionally vulnerable web application — practice finding and exploiting security vulnerabilities safely.
Open source (self-host)
Free. Self-host or use demo instance. 90+ security challenges of varying difficulty.