Ask HN: Advice for getting into web application pentesting?