It’s been a while, so here’s a new funny WAF bypass mentioned in this writeup:

In the serialized payload:
java.util > Block
javb.util > Pass

https://t.co/cCdX99hM3X