Which attack uses captured data replayed to impersonate a user?

• A. Replay attacks
• B. MITM
• C. Side-channel
• D. Padding oracle

Answer: (A)

Replaying captured data to impersonate a user is a replay attack. In this scenario, an attacker records a valid authentication message or token and later resends that exact data to the server. If the system does not verify that the data is fresh—such as by using a nonce, a timestamp, or a short-lived token—the server may accept the replayed data and grant access as if the legitimate user had authenticated.

Think of it as trusting a previously valid credential after it’s been captured. The defense is to ensure each authentication or session setup includes a freshness guarantee: use nonces or timestamps, implement challenge-response, issue short-lived or one-time tokens, and enforce anti-replay checks at both transport and application layers (for example, TLS protections plus server-side replay windows). This distinguishes replay attacks from other attack types: MITM involves intercepting and possibly altering communications, side-channel exploits rely on indirect leakage like power or timing, and padding oracle targets cryptographic padding weaknesses rather than reusing valid data.