You got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^

A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.

Well I got the admin menu to show up. Still lost the chess game though (my chess skills need work).

Any tips?

I tried brute forcing the login admin panel but no luck yet.

What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".

It sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed.

What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value.

What kind of input could you try to see if that behavior is done securely?

This is a good site to start learning about security: https://owasp.org/www-project-top-ten/

Injection will be the most immediately relevant.

A little bit of python and some stockfish could probably improve your play dramatically!

https://github.com/official-stockfish/Stockfish

Lol I thought about it. Thanks for the reply.