@WebGoat

OWASP WebGoat

Deliberately insecure JavaEE application to teach application security