WebGoat.MVC

WebGoat is a deliberately insecure ASP.NET MVC web application maintained by OWASP designed to teach web application security 
lessons. In each scenario, users learn their their understanding of a security issue by exploiting a real vulnerability in the 
WebGoat application. 

For example, in one of the scenarios the user must use SQL injection to view data. The application for demo purposes, providing 
users with hints and code to further explain the vulnerability.

This is based on the OWASP web goat Project
https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

The Web Goat ASP.NET project is found here.
https://www.owasp.org/index.php/Category:OWASP_WebGoat.NET

WebGoat .NET in Action
http://blog.diniscruz.com/2013/06/webgoatnet-in-action-and-how-i-set-it-up.html

Open Hacker 
http://www.reddit.com/r/OpenHacker/comments/16750a/owasp_webgoat/

Projects/OWASP Mobile Security Project - Top Ten Mobile Risks 
https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks