Finding gullible servers 

If you have an active Microsoft Developers Program (MSDP) license, you can use these images to test; but for the rest of us without the budget to support this, you can download full versions of almost any operating system or software package from Microsoft for an evaluation term of 60 to 180 days at their evaluation center website (https://www.microsoft.com/en-us/evalcenter/). Both options are suitable, but the frequent need to start fresh and the non-existent cost of the evaluation licenses make the latter a perfectly suitable option. I would recommend having access to images for MS Server 2008, 2012, and 2016 at a minimum, with images configured for IIS and other important web services.

Linux clients are easier. You can locate options for pretty much any variant you need; and for enterprise/commercial variants, you can find a free and community-supported approximation that is extremely close. Most Linux implementations for web services include not only the Linux OS but also the appropriate Apache web server, MySQL database, and PHP versions, which together form the LAMP web stack. Having a current image of a Debian, Ubuntu, CentOS (for Red Hat targets), Fedora, or SuSE Linux can ensure you are ready for any potential scenarios.

The best thing to happen to aspiring pen testers is the advent of the hackable server VMs, of which there are several that allow practicing attempts against a wide variety of vulnerabilities. Rapid7 released and supported the Metasploitable VM (https://information.rapid7.com/metasploitable-download.html), which is a little longer in the tooth but is well worth in practicing against for general penetration testing. Web penetration testing, however, benefits from an appropriate image with preconfigured applications, so we can get right to the fun stuff.  The images of interest are the Damn Vulnerable Web Application (DVWA, http://www.dvwa.co.uk), the OWASP Broken Web App (https://sourceforge.net/projects/owaspbwa/files/) and the Beebox VM (a VM-based version of the Buggy Web Application or bwAPP module, available at http://www.itsecgames.com). Additional VMs for practice can be found at VulnHub (https://www.vulnhub.com/).