This is a neat set of very straightforward exploitable pages. I have 3 suggestions. The first one is that your HTML is formatted very nicely in most places, if you formatted your code nicely too then it would be easier to read and to a certain extent understand what is going on with the application.
The second suggestion is since you included something on brutus, include something on .htpasswd files and using john or cain to crack them. Maybe make it something to do with a combination of a LFI.
Another one might be to create a blind sql injection and suggest a tool like sqlbrute to map out table structure and eventually get the data.
This is a really nice basic set of test applications to try out these types of vulnerabilities. Thanks for putting all of these together
