I've just installed
WebGoat and I'm going through it. This looks great, something like HackThisSite, but it runs on your own machine. I can't believe I missed this on OWASP before.
I've been playing with SQL injection lately, and it's pretty fun. Especially getting to know all the database systems, their quirks and their particular syntaxes that allow things like LIMIT or EXEC. I'm thinking of doing another programming challenge based on SQL injection and other web application vulnerabilities. I'm...