WebGoat is a deliberately insecure web application maintained by OWASP.
This program is a demonstration of common server-side application flaws and server-side protection techniques to identify and remediate vulnerabilities.