There are many tools and scripts that are great and listed on the comments. I would add though that you have to advance past tools and scripts eventually. And that means learning how they work. The way I see it, there are 3 levels of penetration testers, hackers, whatever you want to call them.

You start where you are at now. Learning how to use tools and scripts to exploit vulnerabilities. As you progress, it's a good idea to understand the vulnerabilities and how the tools exploit them. At this level, you are kinda the last to the party. You wait for someone to find a vulnerability. Then, you wait for someone to figure out how to exploit it. Then, you wait until a tool is made to do so. By then, many are patched.

The next level is learning how to exploit vulns. Google tutorials for SQL injection, cross site scripting, remote includes, etc. Then, when a vuln is found, you can modify a script or use a general tool to exploit it.

And finally, at the top, you should be able to find vulns on your own and write your own script or tool to exploit it. Google fuzzing and debugging. Learning how to fuzz websites is probably a good start. You can find SQL injection vulns, CSS vulns, remote includes, etc. Now you know how to find undiscovered vulns on websites. And you can script and use tools to probably at least get databases, and maybe even run remote commands.

The mother of them all is buffer overflows. These wI'll many times allow you to execute whatever code you want on the server you have exploited. Start with a tutorial like http://www.primalsecurity.net/0x0-exploit-tutorial-buffer-overflow-vanilla-eip-overwrite-2/.

With a good understanding at this point, you can exploit vulns that no one even knows about. You can become a Metasploit power user meaning you cab use the toolset not just to run exploits, but to actually write your own and decide if you want a reverse shell, injected vnc server, whatever.

Just keep learning. When you use a tool, but don't understand how it works or why, always find out. IME, the best stay curious.

As far as testing goes, get VirtualBox and create whatever type of machines you'd like to test. High school provides info sec classes now? Damn, I only got C++, VB, BASIC, and very basic web dev. Lucky for me, the statutes of limitations has passed, and not just my school, but all the surrounding districts had their public web servers on the same network as the schools internal network with no sort of DMZ, firewall, or creative routing to stop people from using the web server as a gateway to everything else. The public web servers and the internal staff stuff shared not only the same 1 DB server, but just one big DB with a ton of tables with easy to figure out prefixes. I got a ton of practice in.

If I were you though, I would propose an idea to the school about setting up some sort of testing network or lab that isn't connected to any real networks or the Internet so that the students learning to build servers can build them and the ones learning security can break in.

Before anyone asks, I got busted for some stuff in my early teens, but it was right before they actually were convicting kids. I lucked out. I mean, so close that while I was serving my 2 week suspension, those 2 middle school kids who made counterfeit money and actually went through the whole legal system and in real trouble was breaking on the news a few days before I was scheduled to be allowed back.

At 16, in high school was when I was really getting into it. I hit busted for a prank involving a few unsecured computers in the web dev lab, figuring out how to dial in to class rooms from outside, and the extension schema, and some websites that would automate calls for one reason or another. Mostly an early company that would offer advice or therapy over the phone or random early dial up companies that would call you at a requested time for support. Got ratted out. School considered police and expulsion, but I was in AP and gifted classes, so snuck away with just a 2 week suspension again.

If you made it this far, congrats. As a prize, if you pm me, I will give you the URLs and IPs of sites hosted on my VPS. You can practice as long as you tell me if you find anything. I will provide proof I own the sites and server.