

Web application pentesting.
There are heaps of free resources, a company known as PortSwigger who make one of the most used applications, Burp Suite, offer heaps of free learning paths and tutorials to get you familiar with the skills needed to learn how to do this.
There are then heaps of free bug bounty programs which you can sign up to which allow you to start attempting to find vulnerabilities in web applications for companies which are enrolled with these programs.
I’m not gonna lie and say this is an easy skill to learn but it can definitely be rewarding even with some basic knowledge.
Burp Suite academy learning, all free with interactive labs, you only need to download and install the community version of the application. https://portswigger.net/web-security/learning-paths
Rhana Khalil also has a lot of guides on these labs if you’re someone who learns best by watching others. https://www.youtube.com/channel/UCKaK-XPQAbznwIISC46b1oA
NahamSec is another big figure in the bug bounty community who often puts out helpful content for new comers. https://www.youtube.com/channel/UCCZDt7MuC3Hzs6IH4xODLBw