OWASP WAF protection bypass

It's possible to bypass protection by using non-standard URL encodings...