Become a web application tester: a full OWASP Top 10 breakdown, SQL injection, Cross-Site Scripting (XSS), SSRF, IDOR, and Burp Suite automation.
What you'll practise: Capture and modify requests with Burp Repeater and Intruder; Find and exploit SQL injection on a deliberately vulnerable app; Demonstrate XSS and IDOR flaws, then fix them; Test for SSRF and authentication flaws on a practice app; Complete a full practice test and write the report.