A SQL Injection bypass technique was used to extract user passwords from the users table. The input was placed between %% and a WAF that replaces /* and */ with __BLACKLISTED__. The bypass payload used was ' or '1'='1' — to manipulate the SQL query and retrieve the data. Further analysis is needed to identify the specific WAF vendor and provide detailed technical information for bypassing it successfully.
Original tweet: https://twitter.com/am1rw4ck3r/status/1780387988670697780