A Testbed For Cybersecurity Beginners: Damn Vulnerable Web Application

I'd say sign up for hack the box and pay the 12 or 13 dollars a month for the premium service then you can spin up retired boxes and use the walk throughs to get a feel for the different strategies. After you're comfortable try going back through some of them without the walkthrough. But if it absolutely has to be free look up the walk throughs and then YouTube the Nox Vidmate VLC crap out of the exploit/strategy.