Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy.
...
Online sources: * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here.
* https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one, I didn't know it existed until today.
* overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different.
* https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold.
* https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first.
...
I do a lot of learning through reading, so books:
* Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated.
* Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful.
* Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this.
* Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date.
...
This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.