[Sikom]

I have two recommendations. 1. Use linux or other unix based system, as there are quite a few tools that are more accessible on linux.
Secondly I would recommend doing CTF challenges to practice and learn new methods of explotation (legally). A few different ones I got, varying difficulty and subject.
(DISCLAIMER: I am not affiliated with any of these sites in any way, and I can not say anything of their quality)
http://overthewire.org
https://picoctf.com/
https://attackdefense.com/
https://www.hackthebox.eu/
https://ctftime.org/
https://www.root-me.org/?lang=en
https://capturetheflag.withgoogle.com/
https://www.vulnhub.com/
https://crackmes.one/
https://www.holidayhackchallenge.com/2018/
https://www.owasp.org/index.php/Category...at_Project
https://www.owasp.org/index.php/OWASP_Security_Shepherd
https://www.owasp.org/index.php/OWASP_Ju...op_Project
https://www.hackthissite.org/
https://cryptopals.com/
https://19.tghack.no/