What a replay attack is
A replay attack is a network attack in which an attacker captures valid data being sent between two parties and then sends it again later to produce an unintended effect. The attacker does not need to understand or decrypt the data; they simply reuse it. For example, capturing the message that unlocks a door and replaying it later could open the door again, even though the attacker never knew the actual secret involved.
How it works
First the attacker eavesdrops on a connection and records a legitimate transmission, such as a login exchange or an authorization message. Later, they resend that exact recorded data to the server. If the system accepts any valid-looking message without checking whether it has seen it before, it will process the replayed message as though it were a fresh, genuine request, letting the attacker repeat an action they were never authorized to perform.
What makes systems vulnerable
A system is vulnerable to replay when its messages stay valid indefinitely and carry nothing to mark them as unique. Encryption alone does not help, because the attacker is reusing the encrypted message as-is rather than reading it. The missing ingredient is freshness: a way for the receiver to tell a brand-new message apart from an old one that is being sent a second time.
How to prevent it
The standard defenses add freshness to each message. A nonce is a random number used only once, included so the server rejects any message bearing a nonce it has already seen. Timestamps let the server refuse messages that are too old. Session tokens that expire, and sequence numbers that must keep increasing, work the same way. Together these ensure a captured message cannot be successfully reused later.
Where it shows up
Replay attacks appear in many settings: network authentication, payment systems, wireless car keys, and web sessions. Security protocols are specifically designed to resist them; for instance, the handshakes behind secure web connections and authentication systems build in nonces and other freshness checks. Keyless car entry systems have had to add rolling codes precisely because early designs were vulnerable to capturing and replaying the unlock signal.
The bottom line
A replay attack reuses captured, legitimate data to trick a system into repeating an action, without the attacker needing to break any encryption. The cure is freshness: nonces, timestamps, expiring tokens, and sequence numbers that let a receiver reject anything it has already processed. Understanding replay explains why secure protocols go to such lengths to make every message provably one-of-a-kind.
Related on Skillo
See also: What is a man-in-the-middle attack? Explained, What is encryption? End-to-end explained.
Sources
Published date reflects the original event date (2026-10-23). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.
Leave a Reply