Learning by doing isn't just a nice-to-have in cyber security; it's essential. You can read about vulnerabilities all day, but until you've exploited one in a controlled environment, you don't truly understand the attack vector.
Always understand the "why". Don't just follow step-by-step tutorials. When you run that Nmap scan, understand what each flag does. When you exploit that buffer overflow, know why those specific bytes cause the crash.
Question everything. That includes your assumptions, the tools you're using, and even the advice you're getting. This skeptical mindset is what separates script kiddies from real security professionals.
Do it on your own. This one hits different in cyber security. It's tempting to immediately ask for help when you're stuck, but the struggle is where the learning happens. Many tasks are genuinely difficult, but they provide invaluable learnings along the way.
Learn to ask good questions when you do need help. Show your work, explain what you tried, what you expected, and what actually happened. This demonstrates effort, helps others learn from your process, and dramatically increases the likelihood someone will help you.
Stay legal. Always. Before doing any security work, ensure you have a signed scope document that clearly defines what you're authorized to test. Stay within that scope no matter what you discover. Your curiosity and skills are powerful tools. Use them to build, protect, and defend - never to harm.