Run IP sweeps on large IP blocks looking at the RDP port (3389). Dictionaries and brute-force apply to test credentials. Locate misconfigured/insecure RDP services which may be used. Mirrored MegaNZ 4Shared MediaFire