During the identification phase of a Web server compromise, you notice the following entries in the web server logs. If "admin" is a valid username, but its corresponding password is not "pass1", and

Web spidering with tools like wget is used to crawl and map web content, not to manipulate authentication sessions or test login credentials.

Account harvesting exploits differential error responses to enumerate valid usernames, but the scenario already reveals which accounts are valid, pointing away from enumeration as the goal.

Session hijacking involves an attacker exploiting an existing authenticated session rather than guessing credentials. The log context - showing that 'pass1' is not the password for the valid user 'admin' and 'root' is not a valid user at all - suggests the attacker is not relying on credential guessing but is instead attempting to capture or forge a session token to impersonate an authenticated user without needing correct credentials.

Password brute-forcing systematically tries many passwords against a known valid username, which is inconsistent with the single-attempt pattern and the presence of an invalid username in the logs.