Can you brute force Dropbox URL? Well, yes, you can also brute force AES256 encrypted file. I think what you are really asking is, would you be successful?
It's quite unlikely. Currently, Dropbox share URL is 11 characters that consists of lowercase alphabets and numbers (36 possible characters). This gives a key space of 36**11 ≈ 1.31621704 × 10^17
possible keys or ln(36**11) / ln(2) ≈ 56.869175 bits
.
Now this boils down to a math problem: suppose that there are m occupied keys in a key space of 36**11, if an attacker sends n guesses, what is the probability that at least one of the guesses matches an occupied key.
How many files are in Dropbox that have share URL? I don't think Dropbox published this data, so I'm going to make a guess. Let's say there's 1 billion files with share URL.
If the attacker makes a single guess, he has a 1000000000/36**11 = 7.59753119 × 10**-9 =
chance of guessing one key in one guess.
Suppose that the entire Dropbox security response team is on holiday and the attacker managed to make 1 million guesses before Dropbox noticed something's up and shut the attacker down. Then the chance that at least one of the million guesses matches an existing document is 1-(1-1000000000/36**11)**1000000 = 0.00756874289
.
Which is about 0.75% chance that the attacker will be able to retrieve a single random file after one million guesses.
In practice though, Dropbox probably have measures to detect and block automated random key requests.