The right tool
hydra (installed here) is built for exactly this: throw a wordlist at a login and report what works. Against a form login it looks like this — you give it the user, the wordlist, the host and port, and how to recognise failure:
hydra -l bob -P /usr/share/wordlists/list.txt 127.0.0.1 -s 8080 http-post-form "/app/login:username=^USER^&password=^PASS^:Invalid"
Tip: The real defences are the opposite of what this target does: rate-limit and lock out repeated failures, require strong passwords, add MFA, and never reveal whether the username or the password was the part that was wrong.