Bruteforce Different Protocols
checklist
Summary
Try username-as-password; re-run against every newly found credential.
Walkthrough
Spray discovered credentials across other protocols (WinRM, RDP, MSSQL, FTP) since users reuse passwords. A hit is a valid login on a service that grants a foothold or admin access.