Hackazon

Hackazon is a project from Rapid7, the company that makes Metasploit. It was first intended to demonstrate the effectiveness of their web vulnerability scanner and then released as open source. This is a modern web application (that is, it uses AJAX, web services, and other features that you'll find in today's websites and applications). Hackazon simulates an online store, but it has several security problems built in. You can practice online at: http://hackazon.webscantest.com/. Alternatively, if you feel like setting up a virtual server and installing and configuring it there, go to: https://github.com/rapid7/hackazon.