Interesting challenge. Solved it using 2 different ways. If spoiler than remove it. You can using information_schema to solve this problem and then there is another place to look for. sqlmap didn’t help me much . I used union of burp and a local instance of mysqldb to solve this problem. Good learning.