Download the Damned Vulnerable Web App. It's easy to find. I can't set this up on any network accessible machine, so you will need to install this somewhere on a machine of your own.
If you have trouble setting up MySQL, let me know.
If you have trouble setting up Apache, let me know.
If you have trouble setting up IIS, ask someone else.
If you're frustrated by this, this is what security people do. You need to know a little about everything, and you have to be able to generate test environments. Don't be afraid to find a reference on the web and just do what they tell you to do.