Here's a checklist for a web pentest. https://pentestbook.six2dez.com/others/web-checklist
It’s kind of enlightening and empowering to understand how a hacker thinks, the actual tools they use and what to look in a web application to exploit it.
As a quick experience, I once came across a huge vulnerability in a web app I was working, a logged in user could pass a different user ID and our app would send all the other user ID data back!
I was part of a team with much more experience but they never considered intercepting and modifying a request to see how the app behaved