/
← Voltar ao feed
medium

TrustedSec releases waf-fu to harvest and replay credentials from AWS WAF logs exposing unredacted headers

1 fonte(s) · 1 atualização(ões) · publicado 01/09/2026 01:00 · coletado há 1 dia

TrustedSec researcher Lilly Mayo published waf-fu, an offensive tool that pulls AWS WAF log data into a local sqlite database and enables replay of logged requests. During an engagement, the author found WAF logs in CloudWatch that captured all headers unredacted, including session cookies and other authentication material, which can be reused to gain additional access to protected applications. The post shows that retrieving these logs requires mostly read-only permissions, so it is likely to be covered by overly permissive principals. It also documents gaps in AWS's redaction mechanisms that defenders should understand.

Technical Details

  • By default AWS WAF logs capture HTTP method, path, query parameters, header names and values, protocol version, client IP, country and timestamp, with no automatic redaction. Full POST bodies are not captured.
  • Log sources: CloudWatch Log Groups (prefix aws-waf-logs-; logs:DescribeLogGroups, logs:FilterLogEvents), S3 buckets (s3:ListAllMyBuckets, s3:ListBucket, s3:GetObject), and direct request sampling (wafv2:ListWebACLs, wafv2:GetWebACL, wafv2:GetLoggingConfiguration, wafv2:GetSampledRequests).
  • Request sampling returns up to 500 entries from a 5,000 sample set and is not affected by the RedactedFields setting, so headers are returned unredacted.
  • waf-fu offers a TUI to browse, filter and search logs, and replay them as curl commands, through Chrome or Firefox with header injection, or as a HAR export for Burp Suite.
  • RedactedFields gaps: SingleHeader redaction does not apply to rules using the Headers aggregate match type; no effect on request sampling; Amazon Security Lake consumes an independent log stream and respects only DataProtectionConfig.
  • DataProtectionConfig (released February 2025) redacts content for CloudWatch, S3 and request sampling, but aws-waf-token is exempt and SINGLE_HEADER protection does not cover rules inspecting all Headers.

Remediation

  • Restrict who can read WAF logs (CloudWatch, S3 and wafv2:GetSampledRequests) and avoid overly permissive principals.
  • Redact sensitive headers such as Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-API-Key and X-Amz-Security-Token.
  • Prefer DataProtectionConfig over RedactedFields and verify that redaction works as intended, including for rules that inspect all Headers.
  • Ensure nothing sensitive is written to logs that should not be there.

Linha do tempo

  1. trustedsec.com ↗ · pub. 01/09/2026 01:00 · coletado 19/10 19:00 primeiro registro

    TrustedSec releases waf-fu to harvest and replay credentials from AWS WAF logs exposing unredacted headers

    ler a análise desta fonte

    TrustedSec researcher Lilly Mayo published waf-fu, an offensive tool that pulls AWS WAF log data into a local sqlite database and enables replay of logged requests. During an engagement, the author found WAF logs in CloudWatch that captured all headers unredacted, including session cookies and other authentication material, which can be reused to gain additional access to protected applications. The post shows that retrieving these logs requires mostly read-only permissions, so it is likely to be covered by overly permissive principals. It also documents gaps in AWS's redaction mechanisms that defenders should understand.

    Technical Details

    • By default AWS WAF logs capture HTTP method, path, query parameters, header names and values, protocol version, client IP, country and timestamp, with no automatic redaction. Full POST bodies are not captured.
    • Log sources: CloudWatch Log Groups (prefix aws-waf-logs-; logs:DescribeLogGroups, logs:FilterLogEvents), S3 buckets (s3:ListAllMyBuckets, s3:ListBucket, s3:GetObject), and direct request sampling (wafv2:ListWebACLs, wafv2:GetWebACL, wafv2:GetLoggingConfiguration, wafv2:GetSampledRequests).
    • Request sampling returns up to 500 entries from a 5,000 sample set and is not affected by the RedactedFields setting, so headers are returned unredacted.
    • waf-fu offers a TUI to browse, filter and search logs, and replay them as curl commands, through Chrome or Firefox with header injection, or as a HAR export for Burp Suite.
    • RedactedFields gaps: SingleHeader redaction does not apply to rules using the Headers aggregate match type; no effect on request sampling; Amazon Security Lake consumes an independent log stream and respects only DataProtectionConfig.
    • DataProtectionConfig (released February 2025) redacts content for CloudWatch, S3 and request sampling, but aws-waf-token is exempt and SINGLE_HEADER protection does not cover rules inspecting all Headers.

    Remediation

    • Restrict who can read WAF logs (CloudWatch, S3 and wafv2:GetSampledRequests) and avoid overly permissive principals.
    • Redact sensitive headers such as Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-API-Key and X-Amz-Security-Token.
    • Prefer DataProtectionConfig over RedactedFields and verify that redaction works as intended, including for rules that inspect all Headers.
    • Ensure nothing sensitive is written to logs that should not be there.