Yes, first you need to read up on security vulnerabilities: the major types and what causes them. Then, as patio11 suggests, spend some time looking for them.

Yes, first you need to read up on security vulnerabilities: the major types and what causes them. Then, as patio11 suggests, spend some time looking for them. Figuring out how to actually exploit them can be fun, but I tend to think it's of secondary importance. If the elements of a vulnerability are there, chances are someone can figure out how to exploit it. On the other hand, actual exploits tend to be what get you mentioned in the press, which can be valuable for a consultant.