It has become a lot easier to "learn by doing" without breaking any rules.
If you are looking at web application security, there are a number of "simulation" games. The first that come to mind are Damn Vulnerable Web App (http://www.dvwa.co.uk/), The Hackme Bank (http://www.mcafee.com/us/downloads/free-tools/hacme-bank.asp...) or OWASPs WebGoat (https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje...)
DVWA is probably the best choice for somebody with no prior knowledge. A quick google search on "dvwa walkthrough" will get you started.