OWASP

Learning

Not that much, but still something:

• OWASP Academy

Development

• OWASP Security Coding Check List

Testing

• OWASP Testing Guide
• OWASP Testing Check List

To give you an idea of what can be automated and what should be performed manually, check out this:

• OWASP Check List Manual vs Auto

• OWASP Top Ten 10

For details about specific attacks and attack payloads, check out:

• PayloadsAllTheThings
• SecLists

Sandboxes

You may try things on:

• http://webscantest.com/
• http://zero.webappsecurity.com

or with OWASP downloadable vulnerable web applications to not mess up the deployment environment, examples of these are:

• Owasp Juice Shop
• WebGoat
• bwApp

Tools

• Burp Suite / ZAP
• Dirbuster / gobuster / wfuzz
• Vega / w3af / arachni / wapiti
• nikto
• nmap
• openssl
• curl
• google dorks