here simple bruetforce tool we just provide username, password list, url , and string that show up when invalid credentials are provided.
and the dictionary is for form fields which the server expects we will provide for post method later
we have to inspect and look at the form fieldset it might say user instead of username so we have to check that out otherwise it won't work

and the response.decode part that function returns raw byte so to compare it with the above string we have to decode it (we can use just response.text too)

last one the password list file have to be in the same directory/folder with the tool

disclaimer: try only in intentionally vulnerable website (like i used metasploitable2 dvwa vulnweb)
any comment on it