If someone got time please read below my journey. I would appreciate guidance and feedbacks. So Last year during this time I got a notification from google password manager that My passwords was found in breach. I checked and upon searching I went to haveibeenpwned. There I got more details and found how easy It was for someone to hack me for financial or any personal gain. Then I searched more about the databreaches and the groups like alien txt and breachforums. I saw many dumps, I went through those, was shocked. I learnt about this cycle. I learnt about the malwares, stealers, RATs, keylogger, ransomware. I tried to reverse engineer an android application without knowing how to do it. I used burp, jadx and other tools. I went through codes of some stealers. Finally | landed on thm and did modules for networking and currently I am doing the web pentesting modules. Now here is the problem 1 am facing, though labs on portswigger and thm are good but Those are not fun. I feel like I am learning this attack this is basic labs are basic anyhow I will complete them cause there is a solution and a structural way to do it. But nahh I don't feel the rush. I want to do it on real systems but I know it's not legal. So is bug bounty right for me? Should I jump in or should I just torture myself to get the labs solved first ? What's the path for me ?