owasp has list of online and offline (virtual machinesisosetc vulnerable web applications that you can test your tooling against in this casethe url that is referenced in the source code points to an intentionally buggy web application hosted by acunetix the cool thing is that it shows you how effective brute-forcing web application can be recommend you set the thread_count variable to something sane such as and run the script in short orderyou should start seeing results such as the ones below[ =[ =[ =[ =[ =[ =[ =[ =[ =you can see that we are pulling some interesting results from the remote website cannot stress enough the importance to perform content brute-forcing against all of your web application targets