I want to perform security testing to my project

I am testing a web application. Currently,I did write test cases , automation coding and functional tesing. Now I want to perform security testing to my project. How I start doing security testing ? What are the possibilities that I want to test ? Is security testing is important for a small project ? How to crack a password ? Is it true to crack a password from a web application ?