OWASP WebGoat is a deliberately insecure J2EE web application created as a learning platform for developers and security professionals to practice identifying and exploiting common web application vulnerabilities. It includes lessons on SQL injection, XSS, authentication bypass, and other OWASP Top 10 vulnerabilities. It is not a scanning tool or proxy.