The answer from raesene4 is the right way to go.

For baby steps I would advise starting with nessus, and metasploit then targeting virtual machines that you build on your own home network.