Automated tools can be used to find XSS vulnerabilities. For WAF filter bypass, try using the payload <script>alert(1)</script>
Original tweet: https://twitter.com/sarthak05623525/status/1775500720273575945