[Zero Two]

CTF Platforms (Capture the Flag)

• HackTheBox (hackthebox.com) - Real-world labs, active community, great for pentesting practice
  
• TryHackMe (tryhackme.com) - More guided, good for beginners, browser-based VMs
  
• PicoCTF (picoctf.org) - Carnegie Mellon's CTF, archived challenges always available
  
• CTFtime (ctftime.org) - Calendar of upcoming CTF competitions worldwide
  
• pwn.college - Arizona State, fantastic for binary exploitation
  

Free Learning Platforms

• OWASP WebGoat - Deliberately insecure web app for learning web vulns
  
• PortSwigger Web Academy (portswigger.net/web-security) - Best free web app security course, full stop
  
• Cybrary - Mix of free and paid courses
  
• SANS Cyber Aces - Free intro to OS, networking, sys admin security
  

Certifications Worth Considering

• CompTIA Security+ - Good entry-level, vendor-neutral
  
• CompTIA Network+ - If you want to nail networking fundamentals first
  
• CEH (Certified Ethical Hacker) - Industry recognised but heavily theory-based
  
• OSCP (Offensive Security) - Hands-on, respected in pentesting roles, hard
  

Books

• "The Web Application Hacker's Handbook"
  
• "Hacking: The Art of Exploitation" - Erickson
  
• "Penetration Testing" - Georgia Weidman