On a slight tangent - I am searching for “learn to hack” courses. Specially focused on web apps deployed on cloud services. Courses that I come across are usually focused on certifications.
I'd say go for CTFs. They are the best way to learn. Also you can download boxes from VulnHub which you can hack. About learning specific attacks you can just pick any book from that list and you'll be good to go. My only advice is to be persistent.
Check out the port swigger academy online and hackthebox as locations to learn. Offensive Security’s proving grounds also has good content.