The OWASP testing guide is a very good start:
https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf
It covers the process of a web application test and explains 90% of the vulnerabilities you'll find in web apps and how to test for them.
It covers the process of a web application test and explains 90% of the vulnerabilities you'll find in web apps and how to test for them.