Which of the following can be used to perform session hijacking? Each correct answer represents a complete solution. Choose all that apply.

Cross-site scripting (XSS) injects malicious scripts into web pages that execute in a victim's browser and can steal session cookies via document.cookie, sending them to an attacker.

Session fixation forces a known session ID onto a victim before authentication, so once the victim logs in, the attacker can reuse that same session ID to hijack the authenticated session.

ARP spoofing is a network-layer attack that redirects traffic for man-in-the-middle positioning but is not itself a session hijacking technique - it is a precursor that may enable other attacks.

Session sidejacking captures an unencrypted session token by sniffing network traffic over HTTP, allowing the attacker to reuse the token and impersonate the authenticated user.