A good place to start is learning how to poke at some API, and fizzers are a good way to do that. Pick some API that you think is complex (often places with previous bugs still have bugs), find a way to bang on it with all sorts of malformed data until something happens (crash, fault, or such). When you find that, you now have a set of inputs that the API is not sanitized against. Then you can try to disassemble, using tools like IdaPRO (best, but expensive), free reversing tools, kernel debuggers, etc. to get a handle on what is going wrong. At some point you might find the precise error at the assembly level. Then you may try to craft your inputs to bypass checks and affect the underlying system in a way you control. Here there are an astounding number of tricks and ways to bypass various security features, and you will have to read extensively to get a large bag of tricks for this step.

Now you have a decent exploit.

Each of these steps takes learning through just doing it and reading. You'll learn tools for various pieces of the game. But it's doable with decent effort.