OWASP WebGoat is a deliberately insecure implementation of a web application which serves as a learning mechanism for teaching web application security lessons.