Someone wanted to learn this too, so Grasp built them a personal learning path.
You can keep exploring this one or create a path like this one shaped around you.
V1
Module 1
Authorized Practice and a Safe Web-Security Lab
Module 2
Browser, HTTP, and Proxy-Based Testing
Module 3
Mapping a Web Application's Attack Surface
Module 4
Authentication, Sessions, and Access Control
Module 5
Cross-Site Scripting and Browser Trust Boundaries
Module 6
Database and Operating-System Command Injection
Module 7
Server-Side Resource and File Handling Flaws
Module 8