You will probably hear this frequently but having a lab of some sort is crucial for learning and testing things safely, whether it involves information security, or just IT in general. I wouldn’t advise penetration testing, or any sort of testing against something on the internet that you didn’t get permission for.
Before you scoff at the idea of a lab, bear in mind the benefits significantly outweigh the cost. The lab doesn’t necessarily have to be a full 42U rack, although if you have the resources, why not right?