It is very common to find pairs of usernames and passwords used together, especially when default service passwords are kept unchanged. That is why it is better to always start with a wordlist of such credential pairs -e.g. test:test
-, and scan all of them first.
This should not take a long time, and if we could not find any working pairs, we would move to use separate wordlists for each or search for the top 100 most common passwords that can be used.
We can find a list of default password login pairs in the SecLists repository as well, specifically in the /usr/share/seclists/Passwords/Default-Credentials
directory.
ftp-betterdefaultpasslist.txt
can come handy.