As in a basic authentication attack, you first need to identify the request that performs the actual authentication and its parameters in order to attack the correct ones.
In the following screenshot, on the left-hand side, you'll see OWASP Bricks in the authentication form (in the Vulnerable Virtual system main menu, go to Bricks | Login pages | Login #3), and on the right-hand side, you can see the request via the POST method. You'll observe that the username and passwd parameters are sent in the body, while there is no Authorization header:
To do a dictionary attack on this login page, you first need to analyze ...
