Database architectures (i.e. different types of database engines)
SQL syntax (differences between MSSQL and MySQL, etc)
HTTP protocol (incl. how to send raw requests)
SSL/TLS issues and misconfigurations
Intercepting proxies (like Burp Suite and Owasp Zap)
Web
application attacks (SQL Injection, RCE, RFI, LFI, XSS, CSRF, XST, etc.
To learn about these attacks, check out the OWASP Testing Guide, it's
free.)
How files and file permissions work on Windows and Linux
Being able to read and understand either ASP,ASP.NET, PHP or Java for source review purposes. (Can also be used to help developers create fixes to issues you've discovered. This skill is also required for e.g. code injection 0days you discover.)
Knowledge
about web application scanners, their weaknesses and strengths, etc.
(This skill is pretty easy to obtain, but is gained over time the more
you use different scanners and learn which ones are generally the best
for your projects. FYI actively scanning a web application without
permission is generally illegal.)
Web services architecture
Web services vulnerabilities
