All of the above... & more.
Knowledge of OWASP top 10 is very helpful. PHP knowledge is also helpful on a large portion of the boxes.
Get familiar with Linux if you aren't already, as you will need to be able to notice things that are not part of a default Linux installation. I would suggest grabbing a cheap VPS (from somewhere like DigitalOcean) and setting up Apache/MySQL/etc. A good project would be to set up your own webserver with a Wordpress installation. Once you have that set up, you will be able to compare HTB boxes to your own to see what is out of place.
Click here to create an account.