A penetration tester is conducting an assessment against a web application and has observed that session tokens are not rotated after login. Which type of attack could the penetration tester employ to take advantage of this vulnerability?
Cross-site scripting (XSS)
Cross-site request forgery (CSRF)
Session replay
Session fixation