Understanding how to log in is just the first step. Once inside, the real learning begins. bWapp is unique because it offers :

BWAPP stores passwords as MD5 (no salt). This is weak—attackers can use rainbow tables. Modern apps should use bcrypt, Argon2, or PBKDF2.