Web Security Dojo

Feature Overview

Convenient virtual machine image
(VirtualBox v3.2 or later recommended, VMware provided)
Targets include:

    OWASP’s WebGoat
    Google’s Gruyere
    Damn Vulnerable Web App
    Hacme Casino
    OWASP InsecureWebApp
    w3af’s test website
    simple training targets by Maven Security (including REST and JSON)

Tools: (starred = new this version)

    Burp Suite (free version)
    w3af
    sqlmap
    arachni *
    metasploit
    Zed Attack Proxy *
    OWASP Skavenger
    OWASP Dirbuster
    Paros
    Webscarab
    Ratproxy
    skipfish
    websecurify
    davtest
    J-Baah
    JBroFuzz
    Watobo *
    RATS
    helpful Firefox add-ons

[Download]

Source: https://www.mavensecurity.com/web_security_dojo/