Vulnerable Web Application

Start Page
HTTP and HTML Security
HTML Tampering
Authentication Flaws
CSRF
Cross-Site Access (CORS)
PostMessage
Cross-site scripting (XSS)
Server-side
Client-side
Injection
SQL Injection
XPath Injection

Insecure Password Reset
Guess the Password

Reset the password for the user: Tom. You known the color of Paul -- blue.