A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
MITRE ATT&CK techniques associated with this weakness class (mapped via MITRE CAPEC). A vulnerability of this type could let an adversary carry out:
A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.
Use the weakness as the way in — the first foothold on the system.
The vulnerable entry point (an input, endpoint, or dependency) that accepts attacker-controlled data.
Validate and sanitise all input at the boundary; patch to a fixed version.
Stay in even after reboots, patches, or credential changes.
Startup hooks, scheduled tasks, config, and accounts the attacker can plant a backdoor in.
Integrity monitoring of code, config, and scheduled tasks; short-lived credentials.
Gain higher privileges — from a limited account to admin/root.
Over-permissioned services, weak file/permission boundaries, and setuid paths.
Drop privileges, enforce least privilege, and lock down file permissions.
Steal passwords, tokens, keys, and session material.
Passwords, API keys, session tokens, SSH/TLS keys, and secrets in memory, env, or config.
Secret managers, short-lived tokens, and no secrets in code/env/logs.
Pivot from the compromised system to others on the network.
Adjacent servers, databases, and internal services reachable from the foothold.
Segmentation, per-service auth, and blocking reused credentials across systems.
Gather the valuable data before taking it out.
Databases, files, customer records, source code, and business data.
Data-access monitoring, encryption at rest, and least-privilege data access.
This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.