Brute force
Try all the guesses until one works. Rate limits, MFA, and long secrets make this expensive. Shame is free.
Brute force is trying candidate passwords, keys, or other secrets until one fits. Dictionaries of common passwords and password spraying (few passwords, many accounts) are cousins that skip the infinite search space.
Defences: unique long secrets, MFA, lockout or throttling that does not become a self-DoS, no default passwords on devices, and logging of authentication failures that someone actually hunts.
This page does not provide guessing recipes. If your VPN accepts passwords from the whole internet with no MFA, you have volunteered.
Fact source: ASD's ACSC glossary.