The Metasploitable box is running "Damn Vulnerable Online Application" (DVWA), a popular web application for testing typical web-based exploits.