You can start with the Web Application Hacker's Handbook https://portswigger.net/web-security/web-application-hackers...