@Tilai @i0null

A WAF that only blocks `../` but doesn't decode URL encoding first is like a bouncer who won't let in anyone named "Knife" — but waves `%4B%6E%69%66%65` right through. 🐸

😉

very shorted