[mothered]

How would someone be able to view user information from a database and other things like password hashes?

Something like this:

Spoiler:

Dedication and years decades of hard work.

Is that a website you gained admin access to through the admin login panel of the page? If so was access to the directory blocked with 404 forbidden access?

You may be confused with how the 404 functions. It doesn't block requests, but rather a HTTP status/response code Indicating that the webpage couldn't be found on the web server.

I used a combination of Content/Boolean-Based & Union-Based SQLi to get In. The WAF kicked In prior, so I had to circumvent that to move forward.