In which of the following attacks does an attacker use packet sniffing to read network traffic between two parties to steal the session cookie?

Session fixation forces a victim to authenticate using a session ID that the attacker already controls and knows in advance, rather than passively sniffing the network to steal an existing authenticated token.

Cross-site scripting (XSS) injects malicious client-side scripts into web pages viewed by other users and while it can steal cookies via JavaScript, it does not involve packet sniffing of network traffic.

Session sidejacking - also called cookie hijacking - involves intercepting a valid session token transmitted over an unencrypted channel such as plain HTTP using a passive packet sniffer. The attacker injects the stolen cookie into their own browser to assume the victim's authenticated session without ever needing the user's credentials.

ARP spoofing poisons ARP caches to redirect traffic through the attacker's machine and can serve as a setup for sniffing, but it is itself a network-layer redirection attack - not the act of reading traffic to steal a session cookie.