Is the evil twin attack included in the sniffing category ?
I am really confused and i can't tell if it is.
The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc.
It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.
Attackers who set up Evil Twins (An Evil Twin is a rogue wireless access point set up to mimic legitimate company wireless access points; many times the SSID is duplicated to make it look like it's the official SSID of the company) usually use some sort of sniffer/protocol analyzer, but the Evil Twin in and of itself is hardware; a rogue AP.
To answer your specific question, about whether it's in the sniffing category, that depends on which book you read or who you're talking to that's doing the classifying. While the Evil Twin itself is not technically a sniffer (it's a rogue AP), there are other tools that would be used in conjunction with it that are in the "sniffing" category as you put it. These tools would include protocol analyzers and other sniffing tools like Wireshark and Nmap which would allow would-be attackers to sniff packets coming through the Evil Twin. The whole point of setting up an Evil Twin is to be able to sniff out, or peer into, the traffic that gets directed through the rogue AP.