These sites are classed as ‘Safe To Hack’, some of the sites are setup so they present challenges and others are just OK to scan.
http://www.hackthissite.org/ – A series of challenges that get harder and harder.
http://www.mibs-challenges.de/ – in German, but google translate makes it acceptable.
http://demo.testfire.net/ – A Demo Banking Site to test ‘Watchfire’ products.
http://scanme.nmap.org/ – NMAP scanning site.
http://www.hackertest.net/ – A series of challenges that get harder and harder.
http://www.dareyourmind.net/ – A series of challenges
This blog page by Duncan Alderson has some more sites and also a great section on Live CD/VM’s or Offline stuff