Login Page

SQL Injection to login

Not only select statements can be vulnerable to SQL Injection, you can use SQL Injection on INSERT INTO in order to add the admin user to application.

SQL injection to login

<LOGIN>' or 1-1 -- //

SQL Wildcards to login

*

Default Credentials

Google: Default credentials [software name and version]

Brute Force

Intruder with SecLists

Credentials Hunting

Explore web application and search for credentials. Use login as password. Spray every port with found credentials.