OWASP vulnerable applications are web apps that are broken on purpose so you can legally practice finding and fixing real security flaws. The best starting points are OWASP Juice Shop, WebGoat, Mutillidae and Security Shepherd. Run them locally in containers, never expose them to the internet and work through the OWASP Top 10 one category at a time.
Nobody learns web security by reading alone....
