Pentesting not from scratch?

Question

Information Security

Hello.
I have some experience (5 years) in full-stack (I know Haskell, Node.js, Go, Nim, and several other languages ​​as a back), I'm used to self-learning. Lately I've been reading about pentesting. I would like to get some knowledge in this area, sufficient or a little more to ensure the security of my sites.
What is better to read about this from free / paid online resources / books? How long can it take in my experience? What difficulties may arise? Where is the best place to test your skills in this area?

Answer 1

THP3
The book covers issues such as:
1. attacks on AD and Kerberos
2. attacks on Webapp
3. vulnerabilities in cloud architectures
4. password cracking
5. physical attacks
6. privilege escalation
and many others.
There are also labs, links to resources inside the book.
Pentest web applications articles
from paid resources there are also online courses.