WackoPicko is an intentionally vulnerable web application designed for security testing and educational purposes. The application contains known security vulnerabilities that can be used to test web vulnerability scanners and practice penetration testing techniques. Originally developed for academic research in the paper "Why Johnny Can't Pentest: An Analysis of Black-box Web Vulnerability Scanners," WackoPicko serves as a controlled environment for analyzing the effectiveness of automated security scanning tools. The application is included in the OWASP Broken Web Applications Project, which provides a virtual machine containing multiple vulnerable applications for security training and testing. WackoPicko is available as a Docker image, enabling users to deploy and run the vulnerable application with minimal setup requirements. The platform provides a realistic web application environment with intentional security flaws, making it suitable for security professionals, researchers, and students who need to practice vulnerability identification and exploitation techniques in a safe, controlled setting.