- Damn Vulnerable Web App – Learn & Practice Web Hacking.
- Vicnum – Lightweight Vulnerable Web Application.
- Web Security Dojo – Training Environment For Web Application Security.
- WackoPicko - Why Johnny Can’t Pentest: An Analysis of Black-box Web Vulnerability Scanners? [PDF]