If you’re asking because you want to learn, then I’d say most learning is done through practice. To put it simply: you need to know what to look for, and then what to try once you find a vulnerability.

DVWA is one resource that lets you learn as you exploit common web vulnerabilities. There are fourteen listed vulnerabilities that you can work through on differing levels of security (aka difficulty levels). It’s a neat little learning experience because you use the provided source code and hints to exercise all the vulnerabilities. Working through each level also exposes you to quite a few tools (like Burpsuite). You can find walkthroughs online that explain how to set it up.

Obviously, in real life you won’t know what you’re looking for and exactly how many vulnerabilities there are, but it’s great exposure for someone who is learning.