Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is…

Session fixation involves an attacker forcing a victim to use a known, attacker-controlled session ID before authentication occurs, not capturing and replaying credentials after a legitimate session has already completed.

Cross-site scripting (XSS) involves injecting malicious client-side scripts into web pages that execute in a victim's browser, which is unrelated to intercepting and replaying authentication credentials over a network.

Firewalking is a network reconnaissance technique that enumerates firewall rules and permitted ports by crafting packets with specific TTL values, not a method of intercepting or replaying authentication data.

A replay attack occurs when an adversary captures a valid authentication credential or session token and retransmits it at a later time to impersonate the legitimate user. Eve eavesdrops on Alice's password, waits until the original session ends, then replays that exact credential to Bob - who accepts it because it is technically valid, even though Alice is not the one presenting it. The standard defense against replay attacks is to use challenge-response mechanisms, timestamps, or nonces that make previously captured credentials invalid upon reuse.