Someone wanted to learn this too, so Grasp built them a personal learning path.
You can keep exploring this one or create a path like this one shaped around you.
Recommended resources
Module 2
Information Gathering and Enumeration
Module 3
Web Application Reconnaissance
Module 4
Exploiting Web Application Injection Flaws
Module 5
Exploiting Authentication and Access Control
Module 6
Exploiting Client-Side Vulnerabilities
Module 7
System Exploitation and Initial Access
Module 8
Windows Post-Exploitation and Privilege Escalation
Module 9
Linux Post-Exploitation and Privilege Escalation
Module 10
Active Directory Reconnaissance and Attacks
Module 11
Active Directory Domain Compromise
Module 12