[zn0]

I second fuzzing the site manually for vulnerabilities, it's a lot more quiet and you'll most likely have a lot more success compared to automated scanners. Sometimes I use tools after identifying a vulnerability to exploit it more easily though, like sqlmap. I'd suggest starting off with simple vulnerabilities like XSS or error-based SQL injections if you want to get into the basics of web-exploitation. OWASP is a great source of information too.