WAF / filter bypass

When it applies

The vuln is real but a WAF or input filter blocks the exploit payload (sudden 403/406/429, a block page, or your keyword silently stripped). You need the same payload in a form the filter doesn't recognize but the backend still executes.

Why it works

A WAF pattern-matches a normalized view of the request; the backend parses it differently. Every gap between those two parsers — encoding, case, comments, alternate syntax, request shape — is a bypass. The goal is a payload the WAF doesn't flag but the app still runs.