Ask HN: Web Security Experience

Dear HN,

I've been slowly going through tpacek's book list - but the learning process has been stifled. I find myself wanting to try out some of the techniques but I am hindered due to concerns about legality.

I realize one can use resources such as http://www.hackthissite.org/ and Stripe's CTF challenge, but are there other forms of resources for practicing web security?