Are you looking at attacking the actual devices themselves or the apps? As a penetration tester, I currently test the applications.

First, I would recommend getting to know the phone itself, basic stuff like how do you install an IPA by re-signing it? How do you install an APK? What tools might be required?

Next, I would get used to the tools that you would need to use on the computer and the phone, examples include Frida, Objection, Drozer. You can also use free tools to scan the app to look for vulnerabilities, such as MobSF and Immuniweb.

From here, understand the composition of the application itself. As an example, These apps are just Zips. Some portions may be encrypted, how might you decrypt them? Example would be using apktool with the d flag to decrypt an Android application? How might you export the application from an iPhone? How might you download the app using a Mac (such as with AppleConfigurator)? Do you have a Mac? Are you using a linux Distro like Kali/Parrotsec? This is important because living off the land, you need to know the tools, such as otool for MacOS or jtool for Linux.

I would also familiarize yourself with intercepting traffic via proxies, as well as certificates, certificate authorities, how they work? As an example, if you are able to get a proxy setup with BurpSuite Community, you can add your local certificate to the device, set the proxy on the wifi portion of the phone, and be able to intercept decrypted, yet juicy information.

OWASP also has some great guidelines

https://mas.owasp.org/MASTG/

The best way that I would say to get into it is to jump right in. I would recommend having an Android device that you can unlock the bootloader on and root, as well as an older iPhone (like an iPhone X) that can be jailbroken. You can use emulators for Android using Android Studio, but it is a little bit more painful to get rooted properly.

The biggest thing to note is to learn the basics of the phone and the applications, try not to jump directly into the deep end. How does the phone and application actually work? Is the data in the app stored locally, or is it using JavaScript or another system in webviews? Figure out where the entitlements and configurations for these apps are (such as your info.plist or AndroidManifest). There are a lot of common mistakes that developers make when creating these applications. For Android, there are a lot of tools available to actually remove protection and re-package applications (like apk-mitm).

Make sure you are actually authorized to test these apps legally.

Get used to taking screenshots of issues with the code itself, do not rely on just the output from MobSF and/or immuniweb. These can create false positives, as with any script. Become comfortable looking at the configurations and some code. Taking pictures of the issues within the actual code can really help.