Its hard and I wish I had more info. One thing I do know is that blogs are the worst form of information. I would think being a whiz at Javascript and PHP would be a prerequisite but maybe you just need a good understanding of different specs and protocols.
You don't really need to be a master of a specific language. You just have to understand general programming concepts. The hard part is getting the right approach to searching for vulnerabilities. Learning to recognize everywhere the target system is taking input and estimating what it is doing with that input is where the skill is at.