automationpractice.com - This is virtual shop which was designed for testing purposes only (unfortunately it's in maintenance mode as I write this post...)
the-internet.herokuapp.com - Fantastic site with real exercises
Use the same sites for Mobile app testing.
httpbin.org - Fantastic resource for everyone who is tired of flaky GUI tests and wants to go lower. All endpoint responses (except /xml) are JSON-encoded.
jsonplaceholder.typicode.com - Fake online REST API for testing and prototyping. I have few tests written against in Java + RestAssured. Will show them in one of the future posts.
requestb.in - Testing POST requests my be tricky sometimes. This site allows you to generate private endpoint where you can send everything you want. All that can be verified in human friendly way.
I believe this should be mainly developers duty, but it wouldn't be bad to have some skills in this area too. Don't look for online tutorials, just exercise your app, or delve into framework code (deeper understanding may help you write better tests on higher levels as well). Examples: Selenium, RestAssured, Appium.
www.javadeathmatch.com - cool site which allows you to identify code smells. It even has multiplayer mode
mapil.co - As a tester you probably know how annoying and time consuming testing emails can be. Mapil can make it smoother - it stores emails for us and allow to query them using custom API.
tropo.com - Tropo adds communications features to your app with just a few lines of code. Free for development & testing.
www.softwaretestinghelp.com - This is a little bit tricky because BDD requires clearly defined use cases. I managed to find them here.
testingchallenges.thetestingmap.org - Site has few exercises which all you to identify all the test required for given scenarios, and then evaluate it. Mostly for beginners.
nngroup.com - this is tricky once again. Try to identify scenarios for your app & context using those tips. Really cool article
Hacking community seems to be very active and resource rich. If you want to train you can easily find quite a few resources. Let me give you just a couple of them (most of them from sekurak polish security portal).
21LTR PenTestLaboratory Exploit Exercise Metasploit Hack This Site Game of Hacks
Text Test - If you want to compare texts (like log outputs) this tool is for you. TextTest is an open source tool for text-based functional testing.
I didn't manage to find any punching bags. Any suggestions? Seems like you have to stick with your own website or app.
But i want to learn few things first...
Ok, here are some awesome links
Useful Java Links - Fantastic list of useful Java frameworks, libraries, software and hello worlds examples. If Java is your main language you should really check it.
Awesome Test Automation - A curated list of awesome test automation frameworks, tools, libraries, and software for different programming languages. In many programming languages.
Awesome Penetration Testing - A collection of awesome penetration testing resources.
The list is by no means complete. What else can you suggest?