Sometimes, you just want to tackle challenges outside your lab, contrived by someone else. Here is a quick rundown (stolen shamelessly from pen-test mailing list on SecurityFocus) of some training programs and sites:

webgoat
foundstone’s hacme series
www.pulltheplug.org
hackquest