Hackers can bypass WAFs for SQL injection by injecting an Out-of-Band payload to expose the server's IP. This technique allows them to bypass WAF restrictions and potentially extract data from the database. Blog post: SQLi bypass for WAF using Out-of-Band payload, applicable to various WAF vendors.