ASM Lab Setup

The "hackit yourself auction website" may be a good starting point. It's what they use in instructor-led 4 day ASM training courses. It's a piece of software with almost no built-in security features. Pretty much any attack against it will work. After you successfully execute an attack, try to find a relevant security-check to patch up the attack vector.

https://devcentral.f5.com/articles/configuring-the-big-ip-and-php-hack-it-yourself-auction-site