Insecure web app has several default users. For some targets we list needed creds. Insecure Web App should be one of those targets where we give at least one set of creds. u: asmith p: andy