Goal
The path to "Webセキュリティ担当者のための脆弱性診断スタートガイド 第2版"
Here is the reading path leading up to this book, derived from its dependencies and ordered from the fundamentals.
The path so far (2 books)
Why read this first: Authentication, sessions, and cookies all sit on top of HTTP. Grasping HTTP's behavior from first principles first lets you understand structurally where in the protocol the vulnerabilities in Tokumaru's book actually arise.
Why read this first: After learning the principles of vulnerabilities, verify them with your own hands. Dynamic analysis with OWASP ZAP and Burp Suite lets you feel how attacks you knew only in theory actually succeed in real traffic, closing the gap between theory and practice.