Short answer: by self-teaching and through private forums, but nowadays there are publicly available courses thanks to the rise of pen-testing (legal hacking).reading more