Damn Vulnerable Web Application (PHP, multiple security levels) - **OWASP Juice Shop** — Modern vulnerable app (Node.js, comprehensive) - **WebGoat** — OWASP project with guided lessons (Java) - **bWAPP** — Buggy Web Application with 100+ vulnerabilities - **HackTheBox Challenges** — Web-focused cha