“They have an application called WebGoat, and it's, it's an application that you can, download and install in a VM, and you can start, and so you're not hitting anybody else's environment, you're, attacking it in your own your own localhost.”

Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 2.