WebGoat/WebGoat: WebGoat 8.0 WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.