Right versus wrong
Back at /app/login, a wrong password for user bob gets a clear rejection:
curl -s -d 'username=bob&password=letmein' http://127.0.0.1:8080/app/loginIn the terminal
student@vulntech:~$ curl -s -d 'username=bob&password=letmein' http://127.0.0.1:8080/app/login Invalid credentials
Invalid credentials. Because the app tells you plainly when you're wrong (and never rate-limits or locks out), you can keep guessing until you're right. Weak, common passwords make that fast.