Common combinations (root, admin, password, name of the tech, default user with one of these passwords).
Create a dictionary using Cewl, add the default username and password (if there is) and try to brute-force it using all the words as usernames and password
Brute-force using a bigger dictionary (Brute force)
If the page has "Remember Me" functionality check how is it implemented and see if you can abuse it to takeover other accounts.
Redirects
Pages usually redirects users after login, check if you can alter that redirect to cause an Open Redirect. Maybe you can steal some information (codes, cookies...) if you redirect the user to your web.
Other Checks
Check if you can enumerate usernames abusing the login functionality.
Check if auto-complete is active in the password/sensitive information formsinput: <input autocomplete="false"