This article introduces "waf-fu," a new tool designed to automate the process of analyzing and replaying AWS Web Application Firewall (WAF) logs to identify potential credential access vulnerabilities. The author explains that AWS WAFs, by default, capture a surprising amount of request data, including HTTP methods, URI paths, query strings, and all headers (even session cookies), making them a rich source for attackers if not properly secured. Manual review of these logs for replay opportunities is described as a frustrating and time-consuming process.
The article details how WAF logs can be retrieved from CloudWatch Log Groups, S3 buckets, and directly via WAF sampling, noting that minimal read permissions are often sufficient for access. A critical point is made regarding the limitations of AWS's RedactedFields configuration, which doesn't apply to request sampling or rules inspecting all headers, leaving sensitive data exposed. The newly released DataProtectionConfig (Feb 2025) offers improved masking capabilities but still has specific exemptions, such as the aws-waf-token.
To address these challenges, waf-fu is presented as a TUI-based tool that simplifies the extraction, caching, analysis, and replay of WAF log data. It allows users to browse, filter, and export logs as curl commands, inject headers into browsers, or generate HAR files for tools like Burp Suite. The article concludes by emphasizing the importance of securing WAF logs through proper redaction configurations and strict access control, as any readable data within these logs could be leveraged for unauthorized access.
Top comments (0)