Pikachu is a web application system with vulnerabilities, which contains common web security vulnerabilities. If you are a web penetration test learner and are worried about not having a suitable shooting range for practice, then Pikachu may be just what you want.

The list of vulnerability types on Pikachu is as follows:
Burt Force (brute force vulnerability)
XSS (cross-site scripting vulnerability)
CSRF (cross-site request forgery)
SQL-Inject (SQL injection vulnerability)
RCE (remote command/code execution)
Files Inclusion (file inclusion vulnerability)
Unsafe file downloads (unsafe file downloads)
Unsafe file uploads (unsafe file uploads)
Over Permisson (over-permission vulnerability)
../../../ (directory traversal)
I can see your ABC (sensitive information leakage)
PHP deserialization vulnerability
XXE (XML External Entity attack)
Unsafe URL redirection
SSRF (Server-Side Request Forgery)
Administrative tools
More... (Look for it? There are easter eggs!)