waf-fu, or Some Log Replay Nonsense

This report demonstrates how default AWS WAF logging can expose sensitive request headers and session cookies, describes a new tool (waf-fu) that automates collection, analysis, and replay of WAF log entries to attempt credential access, outlines three common WAF log retrieval methods (CloudWatch Log Groups, S3, and WAF sampled requests) and their permission requirements, and highlights limitations of AWS redaction mechanisms while recommending tighter access controls and use of DataProtectionConfig to mitigate exposure.