I have a scenario where I'm testing for injection points but the authentication form has a challenge token that refreshes with each GET. The credentials are sent in a POST accompanied by that challenge token received in the previous GET to a different URL. Then if the authentication fails in the POST that challenge used in the POST expires.
/loginprovides a challenge token
- POST username + password fields + challenge token sent to
How can I do this type of test with SQLmap?