BadStorehttp://www.badstore.net/
BodgeIt Storehttp://code.google.com/p/bodgeit/
Butterfly Security Projecthttp://thebutterflytmp.sourceforge.net/
bWAPPhttp://www.mmeit.be/bwapp/ 
http://sourceforge.net/projects/bwapp/files/bee-box/
Commixhttps://github.com/stasinopoulos/commix-testbed
CryptOMGhttps://github.com/SpiderLabs/CryptOMG
Damn Vulnerable Node Application (DVNA)https://github.com/quantumfoam/DVNA/
Damn Vulnerable Web App (DVWA)http://www.dvwa.co.uk/
Damn Vulnerable Web Services (DVWS)http://dvws.professionallyevil.com/
Drunk Admin Web Hacking Challengehttps://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/
Exploit KB Vulnerable Web Apphttp://exploit.co.il/projects/vuln-web-app/
Foundstone Hackme Bankhttp://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx
Foundstone Hackme Bookshttp://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx
Foundstone Hackme Casinohttp://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx
Foundstone Hackme Shippinghttp://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx
Foundstone Hackme Travelhttp://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx
GameOverhttp://sourceforge.net/projects/null-gameover/
hackxorhttp://hackxor.sourceforge.net/cgi-bin/index.pl
Hackazonhttps://github.com/rapid7/hackazon
LAMPSecurityhttp://sourceforge.net/projects/lampsecurity/
Mothhttp://www.bonsai-sec.com/en/research/moth.php
NOWASP / Mutillidae 2http://sourceforge.net/projects/mutillidae/
OWASP BWAhttp://code.google.com/p/owaspbwa/
OWASP Hackademichttp://hackademic1.teilar.gr/
OWASP SiteGeneratorhttps://www.owasp.org/index.php/Owasp_SiteGenerator
OWASP Brickshttp://sourceforge.net/projects/owaspbricks/
OWASP Security Shepherdhttps://www.owasp.org/index.php/OWASP_Security_Shepherd
PentesterLabhttps://pentesterlab.com/
PHDays iBank CTFhttp://blog.phdays.com/2012/05/once-again-about-remote-banking.html
SecuriBenchhttp://suif.stanford.edu/~livshits/securibench/
SentinelTestbedhttps://github.com/dobin/SentinelTestbed
SocketToMehttp://digi.ninja/projects/sockettome.php
sqli-labshttps://github.com/Audi-1/sqli-labs
MCIR (Magical Code Injection Rainbow)https://github.com/SpiderLabs/MCIR
sqlilabshttps://github.com/himadriganguly/sqlilabs
VulnApphttp://www.nth-dimension.org.uk/blog.php?id=88
PuzzleMallhttp://code.google.com/p/puzzlemall/
WackoPickohttps://github.com/adamdoupe/WackoPicko
WAEDhttp://www.waed.info
WebGoat.NEThttps://github.com/jerryhoff/WebGoat.NET/
WebSecurity Dojohttp://www.mavensecurity.com/web_security_dojo/
XVWAhttps://github.com/s4n7h0/xvwa
Zap WAVEhttp://code.google.com/p/zaproxy/downloads/detail?name=zap-wave-0.1.zip