DVWA

DVWA (Damn Vulnerable Web Application) is a wargame that covers a series Web exploitation techniques. The installation guide can be found on Github:

I recommend building with Docker:

docker run -d --rm -it -p 80:80 vulnerables/web-dvwa

Once built, click "Setup DVWA => Create / Reset Database". The default login credential is admin:password.