The best way to learn is by doing. I am not suggesting anything illegal mind you, but see if you can get a pen-testing gig. Find a local small business and do it pro-bono. Find a church and offer your services to them. Just a few suggestions if you go this route:
- Have them back up before you do anything!
- Just start out by doing passive and active recon.
I know port scanning isn't necessarily the glamour of pen testing, but it's a good place to start.
Updating my answer since so many downvotes. I maintain that the best way to learn is to do, but STRONGLY state that you should not ever hack any company without express written consent from the owner, and even then, you should get a lawyer involved (IMO). Also to the points below, if you don't know what you are doing, you can brick something. It's better to learn on your own stuff. So,
Don't hack. Stay in school. Don't do drugs.
Now that the disclaimer is done:
I have started checking out a few tools with Kali Linux (formerly backtrack), and there are a lot of great tools there. The one I'm on right now is DVWA (damn vulnerable web application), which has a customize-able security level for you to try your hand at CSFR, XSS, Brute Force attacks, SQL injections, Remote shell execution, etc. There are a few other resources like this, a google search will reveal it. Just think, "what do I want to pwn?" if the answer is systems, networks, or applications, include that in your search.
A few more resources: