Noob asking for some advices

I'm new to this field, i will describe my progress first:

I was self learning about network, osi, learn to use basic tools, linux
command, read cve and understand public exploit poc, up to now, i'm
trying to understand some cve and read the exploit then translate it to
use on burp or curl (reason for this is i don't want to get a trojan
poc), the cve i tried is about path traversal then rce, i tried to use
AI before, allow AI use nuclei to scan target and i realize website has
something called waf and waf block or timeout my request, which is
annoying, then i have to try it manually, use burp, curl with proxy to
avoid rate limit, change user agent, bypass waf successful and send
request to see if site is vulnerable or not then i send second request
to get my webshell into it, this time it's timeout or block again, then i
tried to encode the endpoint, success, it;s return 200 but the site is
not accept any php file (i tried php, phtml, phar,...etc and none get
through), it's a success for me because this is my first time doing a
lab (i shouldn't called it's a lab because it's a real site) and learn
something from it, something youtube videos never talk about.

My question is: am i on the right path ? I need to ask this because i'm
self learning and need advice from real hackers, my goal so far is get
webshell into a website, learn how to to operate webshell after
successful get it into website then i will learn how to make money from
it later, i know my question is weird, that's why i describe my progress
so far.

Thanks for reading.

[removed]

What's your knowledge base? Have you learned from Google and YouTube but you're all over the god damn place?

It's best to take courses that are meant for the "professional" hackers
to have a solid foundation to build on. If your foundation is all over
the map it's best to stop, re-plan, and re-educate yourself.

I have programming knowledge, just
switch for magecart/formjacking purpose, from that purpose, i research
about path traversal, file incursion and rce cve and try to do it.

I don't take any course for "professional" hacker yet, all things in my
post learned from thm and portswigger, youtube don't help me much
because when i search for it, all i saw is clickbait, can you give me
advice about course ?

There are many ethical hacking courses
out there to learn from. I'd suggest hitting the good old job search
website of choice and see what qualifications professional hackers need
and focus on those certificates and education.

If you're after web application hacking there are many courses, including BurpSuite, that offer such things.