Intentionally Vulnerable Applications > NodeGoat

OWASP - A Node.js web application that demonstrates and provides ways to address common security vulnerabilities.