Json

Hi everyone,

Stuck on initial foothold.
General noob question:
Is it correct of me to presume that obtaining the username + password for the logon page is essential before considering sending any form of payloads?