XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.