Which of the following attacks is commonly combined with cross-site scripting for session hijacking?

CSRF is commonly combined with XSS because an XSS payload executes in the victim's browser context, giving it access to document.cookie and the ability to exfiltrate session tokens. This bypasses the same-origin policy that would normally prevent cross-origin reads. Together, XSS provides the execution vector and CSRF leverages the hijacked session to perform unauthorized actions on behalf of the victim.

Clickjacking tricks users into clicking hidden UI elements but does not involve script execution or session token theft, so it does not combine with XSS for session hijacking.

SQL injection targets backend database queries at the server layer and operates independently of client-side script execution, making it unrelated to XSS-based session hijacking.

Remote File Inclusion is a server-side attack that forces the server to include a remote malicious file and has no relationship to client-side cookie theft via injected scripts.