Injection - sending simple text-based attacks that exploit the syntax of the targeted interpreter. Injection can result in data loss or corruption, lack of accountability, or denial of access.
Broken Authentication and Session Management - uses flaws in the authentication or session management functions to impersonate users. Flaws may allow some or even all accounts to be attacked.
Cross-Site Scripting (XSS) - sending text- based attack scripts that exploit the interpreter in the browser. Attackers can execute scripts in a victim’s browser to hijack user sessions, deface web sites, insert hostile content.
Insecure Direct Object References - an authorized system user, simply changes a parameter value that directly refers to a system object to another object the user isn’t authorized for. Flaws can compromise all the data that can be referenced by the parameter
Security Misconfiguration - accessing default accounts, unused pages, unpatched flaws, unprotected files and directories, etc. to gain unauthorized access. Flaws frequently give attackers unauthorized access to some system data or functionality
Sensitive Data Exposure - stealing keys, do man-in-the- middle attacks, or steal clear text data off the server, while in transit. Failure frequently compromises all data that should have been protected.
Missing Function Level Access Control - Attacker, who is an authorized system user, simply changes the URL or a parameter to a privileged function. This allows attackers to access unauthorized functionality.
Cross-Site Request Forgery (CSRF) - creates forged HTTP requests and tricks a victim into submitting them. This requires an authenticated user logging in.
Using Components with Known Vulnerabilities - identifies a weak component through scanning or manual analysis, then exploit as needed and executes the attack.
Unvalidated Redirects and Forwards - links to unvalidated redirect and tricks victims into clicking it. Redirects may attempt to install malware or trick victims into disclosing passwords or other sensitive information.

Login fails, below is the script just as listed in the lab.