Use requests or if the site has some kind of protection, tls_client for making requests to the server.
Use threading package for making multiple requests at the same time which allows you to check accounts faster.
Steps:
1. Go to your browser and press F12 and then click Network
2. Login to a valid account
3. Look at the apis called
You'll probably see something like this:
https://example.com/api/login
Click on it and then click on the request tab, you'll see some JSON shit.
4. open up an ide and start replicating the same request
5. ???
6. profit
example code:
request = requests.post("https://example.com/api/login",json={"username":"example","password":"examplepassword"}).json()
and then you can parse the json response like this:
is_valid = request["is_valid"]
Start doing this with some small site since those don't usually have the best protection against these attacks.
Good luck