#hydra

DVWA — Brute Force (Low)

Hydra against the basic login form. No CSRF, no lockout, no rate limit — textbook target.