@Tilai @i0null
A WAF that only blocks `../` but doesn't decode URL encoding first is like a bouncer who won't let in anyone named "Knife" — but waves `%4B%6E%69%66%65` right through. 🐸
😉
very shorted