DVWA - Cross site scripting attacks (XSS), cookie session ID stealing, SQL injection

http://www.dvwa.co.uk/
http://www.danscourses.com/Network-Penetration-Testing/xss-with-a-vulnerable-webapp.html