waf-fu: turning AWS WAF logs into replayable requests

TrustedSec researcher Lilly Mayo introduced waf-fu, a tool for finding and replaying HTTP requests from AWS WAF logs. The idea emerged during a penetration test while searching CloudWatch for credentials that could provide additional access to applications.

AWS WAF can store the HTTP method and URI, query string, HTTP headers, client IP, and other metadata. By default, sensitive data is not automatically redacted, so logs may contain Authorization, Cookie, X-API-Key, X-Amz-Security-Token and other headers. The full POST request body is not stored, but the remaining data can sometimes be enough to replay a request.

The tool supports CloudWatch Logs, S3, and WAF request sampling via GetSampledRequests. The last option is particularly interesting: redaction via RedactedFields does not apply to request sampling. As a result, data hidden in standard WAF logs may remain accessible through sampled requests.

Waf-fu loads requests into a local SQLite database and provides a TUI for searching and filtering. Found requests can be: • replayed with curl; • opened in Chrome or Firefox with headers injected; • exported to HAR for Burp Suite. Thus, read-only access to WAF logs could potentially allow attackers to find valid session cookies or other authentication data and reuse them against the application.

TrustedSec recommends restricting access to WAF logs and not relying solely on RedactedFields. The DataProtectionConfig mechanism also applies to CloudWatch, S3, and request sampling, although it has limitations of its own.

Article: https://trustedsec.com/blog/waf-fu-or-some-log-replay-nonsense

Tool: https://github.com/confused-binary/waf-fu