Once you've narrowed down the program you're going to participate in – or maybe you've skipped that and are just plowing through random sites, looking for easy pickings – you can start evaluating individual applications for testing.
Doing so requires an understanding of each application's attack surface. As a quick refresher, Wikipedia sums it up succinctly:
The attack surface of a software environment is the sum of the different points (the attack vectors) where an unauthorized user (the attacker) can try to enter data to or extract data from an environment.
We'll get into actual Attack Surface Analysis in the next chapter, preparing for an engagement, but it helps to have a simple idea of it while evaluating different options.
Using that definition of an attack surface...