Allow me to enhance your list. "Owasp Testing Guide V4" is a must read for web hackers, at least for starters: https://www.owasp.org/index.php/OWASP_Testing_Gu

Allow me to enhance your list. "Owasp Testing Guide V4" is a must read for web hackers, at least for starters: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table... OWASP has vulnerable application projects for you to play with, such as WebGoat "https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project" https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje..., but there are many applications like these such as "DVWA - Damn Vulnerable Web Application" and variants in Node JS (https://n0where.net/damn-vulnerable-node-application-dvna/ https://n0where.net/damn-vulnerable-node-application-dvna/) I also developed two free courses on "WordPress Security" and "Docker Security" https://dadario.com.br/courses/ https://dadario.com.br/courses/ The point is to learn development / infrastructure first, then study attacks and defense to develop a security mindset. Get involved in bug bounties, but learn how to fix, don't let your code skills rust. Then learn more security concepts, how to build a corporate security program and keep moving :) There's also a very famous book in the area: "The Web Application Hacker's Handbook" http://mdsec.net/wahh/ http://mdsec.net/wahh/