SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-replay-attack

Capturing valid login data and sending it again later to impersonate a user is called what?

Replay attack, re-sending captured messages.

Start playing free

  1. A birthday attack
  2. A downgrade attack
  3. A replay attack ✔

Why: The attacker does not need to break the encryption, only to reuse a valid message. Nonces, timestamps and one-time values make old messages useless.

Huh, didn't know that: NIST defines replay resistance as the property of an authentication process to resist replay attacks, typically with an output valid only for one authentication.

The dad joke
A replay attack is just a rerun. The attacker needs a new episode, but got the same one.
Like this card?
Play the game

References

Answer: A replay attack. The attacker does not need to break the encryption, only to reuse a valid message. Nonces, timestamps and one-time values make old messages useless.

  1. NIST CSRC Glossary: replay attack csrc.nist.gov/glossary/term/replay_attack
    replay previously captured messages between a legitimate claimant and a verifier to masquerade as that claimant
    Checked 2026-10-10.
  2. NIST CSRC Glossary: replay resistance csrc.nist.gov/glossary/term/replay_resistance
    The property of an authentication process to resist replay attacks
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyYou sign in, and then the system decides which folders you may open. What is that second step?Security & PrivacyAn attacker secretly positions themselves between two devices to sniff or change their traffic. What is this attack called?Security & PrivacyIn a reflection DDoS attack, what do attackers send to third-party servers?

That's stuff everyone should know.