so far i've only tried free stuff like OWASP WebGoat, and some online hacking challenges (hackthisite, hellbound hackers, ...)

i also took a couple of CS security classes in school but they were not really "hands-on"