Portswigger

All labs: https://portswigger.net/web-security/all-labs

3. sql_injection
4. Authentication Vulnerabilities