For anyone who's after a book: I've found Dafydd Stuttard and Marcus Pinto's "The Web Application Hacker's Handbook" to be invaluable.