Skip to content
REDMAW

SaaS & Identity

Session-Token Replay

A stolen session token can preserve access without requiring the attacker to know the user's current password or complete the normal login flow again.

RedMaw

Definition

After a successful login, the application issues a token representing that authenticated session. Replay means presenting a stolen token to obtain the same access, without repeating authentication.

Why it bypasses the controls people trust

A session token is issued after multi-factor authentication has already succeeded. Replaying it therefore does not encounter MFA at all, and it does not require the password. It bypasses both by arriving after the point where they were checked.

What bounds the exposure

  • Token lifetime and idle expiry
  • Binding to device, client or network context
  • Invalidation on credential change and on privilege change
  • Detection of the same session appearing in inconsistent contexts
  • Explicit session revocation as part of incident response
Where it leads
  1. Token Exposure
  2. Session Replay
  3. User Identity
  4. SaaS / Application
  5. Sensitive Data

Each hop validated by successful exploitation

Tags

  • sessions
  • tokens
  • persistence

Validation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

  1. 01Establish session lifetime, expiry and binding properties
  2. 02Determine whether a session survives a credential change
  3. 03Test whether a session is usable from an inconsistent context, within scope
  4. 04Preserve the session properties and resulting access as evidence

Keep going

Related

Capabilities

Use cases

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demoExplore the platform