Is there a Plug and Play demonstration kit for various types of attacks?

I'm going to lecture a group of students about Information Security. I'm going to explain the theoretical sides of SQLi, Buffer Overflow and XSS.

I wanted to give them a live demonstration without breaking the law. Do you happen to know of any framework (maybe even Metasploit is capable of this) that has various of vulnerable services and programs which I can demonstrate the attacks on?