@mijanhaque_ Try to fuzz for dots files and their backups, especially the (.htpasswd and .htaccess).
Play with HTTP request methods
Brute force using base64 encoding both username and password using basic authentication " base64(username:password)"
....
@nav1n0x since it's a Microsoft SQL server, try to look for adirectory disclosure and try to get a direct sql shell using --os-shell, --os-cmd or --os-pwn for reverse shell. (if it's a previleged user)
@_2os5 Check for the admin's email and search for it on the internet, look where did he suscribed or registred in other websites, thn try to target the website where did he registred get the database and look for the specified email thn get the password, I use this trick sometimes