For web application security try web goat, you can find it at www.owasp.org

SittingDuck