What vulnerabilities predominate now?

Question

Information Security

I still admire people who can find vulnerabilities. These are very brilliant people. How do they do it?
Now after all (large) sites are protected from banal sql-injection, xss.
But how then do people still hack these sites?
I know that there is social engineering, logical fallacies.
But how do they find them? Luck? Experience (and if not)?
Can it be that there is not a single bug, vulnerability, logical error on the site?

Answer 1

But how do they find them? Luck? Experience (and if not)?

Luck also works, I think many have come across such cases. If there is no luck, then you haven’t tried to do anything, because computer technology is riddled with holes like a sieve for pasta, different software vendors pay $ 2,000 per 1 piece for the vulnerabilities you find within four months, especially if they managed to become public