Replay attack: what it is, examples and how to prevent it

Capacitación y Educación en TI

7 Nov 2026, 1:12 p.m. By Juan Carlos Hernandez 💬 0

A replay attack is an attack in which someone captures a legitimate message (a login, a session token, a payment order or a radio command) and sends it again later, unchanged, so the receiving system accepts it as new. The attacker does not need to break the encryption or know the password: the message was valid once, and a system with no replay protection treats it as valid again.

How a replay attack works

Capture: the attacker records traffic on an open or poorly configured network, through a man-in-the-middle position, from malware on the victim's device, or simply by recording a radio signal.

Store: the captured message is kept as it is. It may be encrypted; the attacker does not need to read it.

Resend: the message is sent again to the same server or device. If nothing in it proves freshness (a nonce, a timestamp or a counter), the system runs it again: another login, another transfer, another door opening.

Real examples

Car keys and garage remotes: fixed-code remotes can be recorded and replayed. Rolling codes stop simple replay, although RollJam, shown at DEF CON in 2015, combined jamming and replay to get around them.

Wi-Fi WPA2 (KRACK, 2017): replayed handshake messages forced the reinstallation of a key already in use, which let attackers decrypt traffic. It was fixed with operating system and network device updates.

Session tokens, JWTs and APIs: a token or signed request that never expires can be replayed as is. That is why AWS rejects signed requests older than 15 minutes and Stripe puts a timestamp inside its webhook signatures.

Kerberos (Active Directory): tickets carry timestamps and the default clock-skew tolerance is 5 minutes, yet a stolen ticket can still be reused in pass-the-ticket attacks while it is valid.

Blockchains: after the 2016 Ethereum split, a transaction valid on one chain could be replayed on the other. EIP-155 added the chain ID to the signature.

TLS 1.3 0-RTT: early data can be replayed, so RFC 8446 says to use it only for requests that are safe to receive twice.

Replay attack vs. relay attack vs. man-in-the-middle

A replay attack resends a captured message later. A relay attack forwards it in real time so two distant devices believe they are close, which is how keyless-entry cars are stolen. A man-in-the-middle attacker sits between both parties and can read, change or replay messages; it is often the step that provides the traffic that is replayed afterwards.

How to prevent replay attacks

Nonces: a random value used once per session or transaction. The server records it and rejects any message that repeats it.

Timestamps with a short window: messages outside the allowed window are discarded. Keep server clocks synchronized with NTP.

Short-lived tokens: session tokens and JWTs should expire quickly and be revoked on logout; one-time codes and recovery links must stop working as soon as they are used.

Idempotency keys for payments and orders: the same key processed twice returns the first result instead of charging again.

Signed requests and webhooks: sign the timestamp together with the body and reject old signatures.

Encryption plus freshness: TLS protects the channel, but replay protection comes from the nonce, timestamp or counter inside the message.

How to test whether your system accepts replayed requests

Capture a legitimate request (login, payment, password change) with a testing proxy and send it twice; then send it again after logging out and after the token expires. Every repeat should be rejected. This is one of the checks in a web application penetration test, together with session handling, authentication and API authorization.

Replay attack FAQ

What is a replay attack in simple terms?

Someone records a valid message, such as a login or a payment order, and sends it again later so the system runs it a second time.

Does encryption prevent replay attacks?

Not on its own. An encrypted message can be resent as is; what stops it is a nonce, timestamp or counter that the receiver checks.

What is the difference between a replay attack and a relay attack?

A replay resends the message later; a relay forwards it in real time to fool two devices about their distance.

Are replay attacks still a problem today?

Yes, mostly in APIs, webhooks, IoT devices and radio remotes that do not check freshness. Modern protocols such as TLS and Kerberos include protections, but applications built on top of them must add their own.

How do I know if my application is vulnerable?

Replay captured requests and confirm that the server rejects them. A penetration test covers this along with session and token handling.