I recommend "The Art of Software Security Assessment" (Dowd, Mcdonald, Schuh) if you want a exhaustive book on the subject.
And in addition, The Bug Hunter's Diary: https://nostarch.com/bughunter
Ask HN: How do security researchers know where to look for vulnerabilites?
31–31 of 31 posts