To secure a website or a web application, one has to first understand the target application, how it works and the scope behind it.
The penetration tester should have some basic knowledge of programming and scripting languages, and also web security.