An ESP32 with two buttons opens and closes a garage door by sending requests to a server over an open, unsecured Wi-Fi network. What lets an attacker open the door from a laptop, without the device?
The traffic is unencrypted and unauthenticated. By sniffing one real "open" request, the attacker learns the server's address, port and the exact request, and can send the same request again: a replay attack.
* The server cannot tell the replayed request from the real one. *
The setup gives an attacker everything they need:
- An open network. No Wi-Fi encryption, so every frame can be read by anyone in range, and anyone can join.
- A plaintext protocol. One captured request shows the server's IP address and port, the URL and the body.
- No authentication. The server acts on what the request says, not on who sent it.
- No freshness. Nothing in the request changes from one press to the next, so yesterday's request is as valid as today's.
The attack is then short: capture while the real button is pressed, find the request in Wireshark, and send the same request from the laptop with any HTTP client. No cryptography is broken. The system simply never asked for proof.
The assignment also assumes physical access to the device, which opens a second path: flashing or reading the device's firmware directly.
Go deeper:
Wikipedia — Replay attack — the general attack and the standard countermeasures.