[Cr3aTor]

Don't bother searching around the net. Most either don't work, Infected or a combination of both.

Bruteforcing Facebook accounts will be somewhat difficult- as too many Invalid login attempts against a given account,  will result In an account lockout period.

^ Pretty much, however you could try to make a simple script that rotates proxies every 2-3 POST req and have a delay between requests as well, but that would be really inefficient.
Regardless, social engineering your way in it's way more easier and stealthier.

So, I would say to try and trick the target to give you the credentials and only if you don't really have any other option at all, code a script that would do a dictionary attack by rotating proxies. Yet you should try to generate a wordlist specific to your target with the intel you gathered online/offline.
Is very likely that your typical Joe will have an unsecure password