I can’t remember if I’d mentioned it before, but I will now since I’m snarfing many of the links to add to my own list. Wasim over at Security Thoughts has a nice list of vulnerable web apps you can learn from.