I'm a Java Automated tester for a website built with GWT. My bosses now want me to specialize in security testing. The problem is that nobody in the company knows anything about security testing, except for some light SQL Injection, which is easy to test for either way. The problem I'm having is that they want me to come up with actual cases for XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery). While Google provides some examples for programmers, they do nothing to teach testers on how exactly to test for these vulnerabilities. Is there a place, a tutorial, something that provides actual examples of how people can attempt these types of exploits and how to discover them in your web application?
Google have a great site (gruyere) for learning more about some of the most common security vulnerabilities on the web, you can find it here. It's a good place to start but it is not a comprehensive list of all your security concerns.
You can look at those examples then try to relate them to where they would apply to your application.
http://www.hackthissite.org/ is a useful resource