Web Application Software

Is target running packaged or custom software?

Packaged software:
check version strings
download and hack at your leisure

Custom software:
common bad programming
understand the basics: CGI, URL, HTTP, HTML

Poke the software, see what complains.