OWASP WebGoat 5.4

Overview

WebGoat is a deliberately insecure J2EE web application designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson. 

Releases
WebGoat 5.4 is mainly a bug-fix release.
WebGoat installation instructions

WebGoat 5.4 Standard:

The standard release is a download, unzip, and click-to-run release. It comes with the Java Runtime Environment and a configured Tomcat 7 server. There are versions for 32 bit Windows and Ubuntu.

WebGoat 5.4 Developer :

As of version 5.3, WebGoat now uses maven. See the readme file for instructions on how to build and setup an eclipse environment.

More...