I work as a pentester, and if you want to learn web security, I would strongly recommend PortSwigger Web-Security labs over WebGoat (it's free too).

https://portswigger.net/web-security

Hackthebox with ippsec's videos is also a fantastic resource. Liveoverflow's youtube channel and pentesterlab are also really good.