As well as the password list we used in the previous recipe, in order to execute this dictionary attack, we will need to have a username list. We will assume we already did our reconnaissance and obtained several valid usernames. Create a text file (ours will be user_list.txt) containing the following:

user
john
admin
alice
bob
administrator
user
webgoat
adam
sample