A replay attack is an attack in which a valid data transmission – such as a login message, token or command – is captured and maliciously repeated to gain access or trigger an action again.
How replay attacks work
The attacker does not need to decrypt or understand the intercepted data. It is enough to record a message that the receiver accepts as genuine and send it again later. This requires access to the traffic, typically via a man-in-the-middle position, an open Wi-Fi network or a radio receiver. Typical examples:
- Resending a captured authentication message or hash to log in as the victim (CWE-294, authentication bypass by capture-replay).
- Reusing a stolen session token or a signed API request – closely related to session hijacking.
- Recording the radio signal of a car key fob, garage door or alarm system with fixed codes and playing it back to open the door.
- Repeating a payment or transfer instruction so that it is executed twice.
Why replay attacks matter
Replay attacks show that encryption alone is not enough: an encrypted message can still be valid when repeated. Weak IoT devices and older radio systems remain vulnerable, and protocol flaws such as the 2017 KRACK attack on WPA2 involved replaying handshake messages. Blockchain forks also required replay protection so that a transaction on one chain could not be repeated on the other.
How to prevent replay attacks
- Use protocols with nonces, timestamps or sequence numbers, as TLS and Kerberos do, and reject duplicates.
- Make tokens short-lived and bind them to a session or device; use one-time passwords that expire after one use.
- Use rolling codes and challenge–response in wireless locks and key fobs.
- Require idempotency keys for payment and API operations.
