Can a unathorized user capture a ssl packet, resend it and login?

Question

Here's the scenario:

We have users login on a secure connection. Could an unathorized user capture packets sent from the users machine to the server and then resend them? Would this allow them to login?

This is a homegrown login system running on coldfusion.

Answer 1

Short answer: not with a normal browser.

Long answer: yes, if the user is not careful, and discards the warning the browser provides for not matching server name/certificate.

Good explanation of how SSL works.

Answer 2

No.

Because the attacker in this scenario will still need to negotiate his own SSL handshake with the server, he will be unable to replay the victim's packet verbatim.