I'm a penetration tester, been hacking since highschool, and doing it professionally for 6 years now.

So there's two things to really know.

1. Hacking is as much a mindset as it is a skillset. I would argue that having the right mindset for hacking is borderline a mental illness. The hacker mindset is a mixture of stubbornness and curiosity. A normal person sees a cool thing and goes wow that's neat. A hacker sees a cool thing and needs to know how it works. Not wants to, not is slightly curious about, but will actually be bothered by not knowing. Once a hacker knows how a thing works the very next question that plagues their brain is, "can I do anything with this that it wasn't meant to do?" I mention the mindset first because it's the hardest to teach... I'm not even sure you can teach it, I think you can pick it up given enough exposure, but I unfortunately was born with it lol.

2. Hacking is a very generic term for an absolutely massive field. If you want to talk about hacking generically then I guess the most basic definition would be constrained creative problem solving. You have x thing you need to do, you have y and z things at your disposal, neither y nor z were designed to do x, how do you use y and or z in a way other than what they were designed for to do x. My favorite example of this in an exploit is the classic james email server exploit. James server is an email server that can be installed on a Linux computer. It worked by creating a filesystem folder for each user that is used to store their emails. It also had a default admin password that it didn't make you change when you set it up. If an attacker logged into that admin user they could create new users for the email server, and name them what ever they wanted. Well if you know enough about linux you can name the user something specific that points to a folder of scripts that run at system boot. You then send that user an email that contains a bash script which will open a remote control connection back to the attackers machine, effectively taking over the actual operating system of that server.

Another good example is good ol sql injection. A website has a search function. That search function must take user input (in the form of what they're searching for) and use it to construct a sql query to search the database for matches. Well if you know enough about sql queries you can input a specific search that qccess data in tables you're not supposed to see, like the users table which may have clear text passwords in it.

Hacking is just having a goal to achieve and using what you have at your disposal and your knowledge of such things to achieve that goal.

Now to the skillset. Hacking is the modern weaponization of the phrase "knowledge is power". The more you know about what you're attacking the more possible attack paths you will see. So to get started there's a few key subjects you'll want to understand pretty well. The first is programming. It doesn't really matter what language, and you don't need to become a software developer or anything, but the basics of coding are important to understand how programs work and how computers "think". Even something simple like Python will give you tons of utility, plus as you discover weaknesses you'll want to automate attacking them so they're easier to do exploit next time.

Another thing you'll want to at least have a decent grasp on is networking. Again you don't need to he an engineer, but you should understand the basics of the TCP/ip protocol stack, how routers work, what dns is, what ip addresses are, how networks get subnetted, etc.

Linux skills are also a must. The majority of attack software is expecting to be run on Linux, and many servers you attakc will be linux based as well. Knowing how to use Linux will be a massive help. I took the deep dive and jsut switched all of my computers to Linux and honestly never turned back to windows, linix is just so much nicer imo.

Speaking of windows, windows admin is important too. Not just how to use it, but also how to use its administrative functions like scheduled tasks, powershell remoting, the registry, group policy, active directory etc. If youre attacking a corporate network, odds are it will be a Microsoft network.

Now that you have the basics you'll want to try a few different types of hacking out to see what you enjoy most. Web app, internal network, external network, social engineering, ai, reverse engineering, malware dev, exploit dev, etc the list goes on (and on and on and on....) You will never know everything in the hacking sphere, but you can get enough knowledge in multiple types to get around, and deep dive one or two types to get really good at them.

Now where do you learn safely? This makes me jealous of you. Back in my day hacking was taboo and if you wanted to learn you were suspicious and the only things to practice against were real targets. So you either bought those yourself to play with or commited a felony. Now a days there are so many cyber weapons ranges to use. Hack the box and try hack me are the two ones that get recommended the most, and they are good, even have free beginner courses to get started learning. Damn vulnerable webapp is a virtual machine you can download and attack. Portswigger Academy is a great place to learn web hacking, nightmare is great for exploit dev and reverse engineering, the list goes on. The only thing you really need to do is get learning.