PortSwigger, the company behind Burp Suite, offers a free Web Security Academy with interactive labs on web vulnerabilities. Topics include SQL injection, cross-site scripting, CSRF, authentication flaws, and business logic errors. Each topic has a written explanation followed by labs where you practice exploiting a deliberately vulnerable application. The labs are hosted by PortSwigger, so you don't need to set up anything locally. It's one of the most practical resources for learning how web attacks actually work.

The content is written by security researchers who know the subject deeply. There are labs for every skill level, from apprentice to expert. It's completely free and doesn't require an account for the basic content, though an account lets you track progress. If you're a web developer who wants to understand secu