@J4c said:
Hi, any hint? “unset” is the right path or I have to study in deep classic waf bypass techniques? Thanks:)
There is a risk of overthinking on this one. You can try various things, see if you can get a different response to different requests then, if there is, you can use a tool (s****p) to automate it.
I found it was very, very, very, very slow though. There may be faster approaches.