I study computer science and I have been trying to get into information security, web application penetration testing in specific.
I have a not-bad knowledge programming,networking and operating systems. I have been through few of the recommended material for beginners. books, vulnerable by design applications mentioned in answers to similar questions like: web application hacker's handbook, most of the available vulnerable by design apps like DVWA, Mutillidae, webgoat, bwapp, also did many online webapp security challenges, so I have a very decent understanding of how web applications work,how major vulnerability types work and how they manifest in the wild, however, when I try to apply this knowledge to a real-life application like a bug bounty program I get overwhelmed by the complexity of modern-day applications and find it difficult to interpret the data I collect to get a real understanding of what I'm facing to conduct an effective penetration test. somehow there's a gap between all the information in books, sitting duck-like vulnerabilities in vulnerable by design apps, and real life complex applications,especially when looking for vulnerabilities that have a big effect on the organization being tested instead of looking for missing headers or uninteresting low-impact vulns.
is this confusion because I lack the background required to conduct such complex tasks effectively like an ex-developer or sysadmin with more knowledge of how things go on the other side? is this background something that I should acquire first through a couple of years of experience before making the move into infosec or should I keep at it the way I'm doing until it ticks?