Jarlsberg

Google has hosted a vulnerable application called "Jarlsberg" to teach interested parties about how to attack and defend applications. Haven't given it a go so I can't comment (yet) how to compares with WebGoat.