Where can I practice security testing? Are there sample unsafe apps?
There are lots of sample applications available which are freely downloadable.
Foundstone released a series of them that you can download from their tools page.
WebMaven is another sample application for trying out attacks.
OWASP also provides a sample application called WebGoat. There are lessons on most of the common vulnerabilities and it can be downloaded from WebGoat sample application.