The request is the unit of attack.

Every web interaction is a request the client fully controls: URL, parameters, headers, cookies, body. The server trusts some of it — and trust in attacker-controlled input is where nearly every web bug lives. Your job: find what the app trusts that it shouldn't.