The easiest way to learn how to exploit is to learn how to prevent exploits in your own code. There are usually lots of tutorials/articles from that point of view. Some easy examples: once you've learned what SQL injection or XSS is and how to prevent it, it becomes easy (almost a habit) to look to see if other apps have done the same.