AWS WAF Logs Exploited for Credential Harvesting

A security researcher detailed the process of analyzing AWS WAF logs to extract credentials for unauthorized access. The researcher noted that AWS WAF captures extensive request data, including headers and IP addresses, which can be leveraged in replay attacks. The logs are not automatically redacted, raising concerns about sensitive information exposure. The researcher developed a tool named 'waf-fu' to streamline the log replay process, enhancing efficiency in identifying potential vulnerabilities. The articles highlight the importance of proper log management and redaction practices to mitigate risks. Current practices may leave organizations vulnerable if sensitive data is not adequately protected. The situation emphasizes the need for organizations to review their WAF logging configurations and implement necessary safeguards.

Key Points: • AWS WAF logs contain sensitive request data that can be exploited. • The 'waf-fu' tool was created to facilitate log replay for credential harvesting. • Organizations should implement log redaction to protect sensitive information.