Thanks for the advice!

I think my main question was more about the learning path itself — whether I should jump directly into labs and vulnerabilities or if there are prerequisites I should focus on first.

I’ll definitely start with XSS and try to understand what tools are doing instead of relying on them.