I sat through way too many #pentest interviews where the candidates had no clue about the fundamentals of web security, like the Same-Origin Policy.
If you want to make a career of finding flaws in (web)apps, do yourself a favor and read nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqupkp7fd7rc3lrjg23r8gy0wc723vze7mxlx5984ut6zurjzpf5xs6ux373 (nprofile…x373)'s HTTP zine:
https://wizardzines.com/comics/same-origin-policy/
