📖 What is Replay Attack?
A Replay Attack occurs when an attacker intercepts a valid data transmission, such as an authentication token or a session cookie, and later re-transmits it to the server to impersonate the original user. This bypasses authentication without needing to know the password.
"The most effective defense against replay attacks is the use of nonces (number used once) or timestamps to ensure each request is unique."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Replay Attack?
- ▸ Packet Capture: Attackers use tools like Wireshark to intercept valid authentication packets or session tokens transmitted over unencrypted or weakly encrypted channels.
- ▸ Session Token Reuse: By re-sending a captured session cookie or token, an attacker can trick a server into believing they are the authenticated user.
- ▸ Lack of Freshness: Replay attacks succeed when protocols fail to implement freshness mechanisms, meaning the server cannot distinguish between original and repeated requests.
- ▸ Pass-the-Hash: A specialized replay attack where the attacker captures a password hash and uses it to authenticate without ever knowing the plaintext password.
- ▸ Mitigation Strategies: Implementing nonces (numbers used once), timestamps, or sequence numbers ensures that each request is unique and cannot be validly reused.
🎯 How does Replay Attack appear on the PT0-002 Exam?
You may be asked to identify a vulnerability in a custom authentication protocol that lacks timestamps, allowing an attacker to capture a login request and reuse it later.
A scenario might describe an attacker capturing a hash during an NTLM authentication process and using it to access a network resource without the password.
Expect questions where you must recommend the most effective mitigation for a replay attack, requiring you to choose between encryption, nonces, or strong password policies.
❓ Frequently Asked Questions
How does a replay attack differ from a standard Man-in-the-Middle (MITM) attack?
MITM involves intercepting and potentially modifying traffic in real-time. A replay attack specifically focuses on capturing a valid transmission and re-sending it later to gain unauthorized access.
Why isn't encryption alone enough to prevent replay attacks?
Encryption protects the data from being read, but if an attacker captures an encrypted authentication packet, they can still 'replay' that exact encrypted blob to the server to authenticate.
What is the role of a nonce in stopping these attacks?
A nonce is a unique, random value sent by the server. The client must include it in the response, and the server rejects any subsequent requests using that same nonce.