# Brute force

### Password Spraying
* [Domain Password Spray](https://github.com/dafthack/DomainPasswordSpray) - dafthack
* [Brute Spray](https://github.com/x90skysn3k/brutespray) - x90skysn3k

### 2FA Bypass
* [CredSniper](https://github.com/ustayready/CredSniper) - ustayready
  * [Stealing 2FA token with Credsniper](https://www.blackhillsinfosec.com/stealing-2fa-tokens-on-red-teams-with-credsniper/)

### Password Dumps
* [hashes.org](https://hashes.org) - Hashes.org

### OWA brute
* [OWA Login](https://www.rapid7.com/db/modules/auxiliary/scanner/http/owa_login) - Metasploit

### RDP Brute
* [RDPSpray](https://github.com/dafthack/RDPSpray) - dafthack

### Wordlists
* [Seclists](https://github.com/danielmiessler/SecLists)
* [Statistically Likely Usernames](https://github.com/insidetrust/statistically-likely-usernames) - Inside Trust
