i tried SQLi but no luck, now using hydra to brute force the user and password… am i on the right track?