3 Ova — Metasploitable

Built by Rapid7 (the makers of Metasploit), version 3 is not just an update; it is a completely different beast. It is intentionally misconfigured, riddled with thousands of vulnerabilities, and designed to teach you how modern Windows (and Linux) exploitation works.