Skimming Credentials with Azure's Front Door WAF

This report demonstrates a configuration abuse technique against Azure Front Door WAF: by creating a low-priority custom rule that matches POST parameters (e.g., 'username' and 'password') and setting it to 'Log traffic only', an attacker or malicious admin with rule-edit and Log Analytics read access can capture plaintext credentials in WAF logs; the write-up details prerequisites, step-by-step configuration, Log Analytics queries to retrieve captured values, and remediation recommendations such as sensitive data masking and strict access controls.