If the admin panel you targeted has a username enumeration , you can brute-force using a wordlist. This has worked many times for me in this case, the username was "admin" My password wordlists: Basic: raw.githubusercontent.com/da… Advance: raw.githubusercontent.com/mr… Usernames wordlist: raw.githubusercontent.com/je… #bugbountytips #bugbounty