This indeed does work. I think the “i” character is the only one in “jndi:ldap” that works like that. Another likely WAF bypass for log4j. https://t.co/EmsGQEHSpM