Apart from the standard methods mentioned by other commenters, you can also play CTFs (and read past CTF writeups). The problems in CTFs are not necessarily ref

Apart from the standard methods mentioned by other commenters, you can also play CTFs (and read past CTF writeups). The problems in CTFs are not necessarily reflective of the vulnerabilities in modern software, but it's a fun way to learn a lot of the tools and mindset involved in real security research.