bWAPP is intentionally insecure — reuse these credentials in real applications or expose bWAPP to the internet.
In the context of web security testing, the login screen is often the first "boss fight." Within bWAPP, you can use the login portal to practice several common attacks: SQL Injection (SQLi): bwapp login password