But is it not like the transport layer is the place where the routing
No, routing takes place on layer 3 of the OSI model, called the network layer.
We are finally routing them to our machine and then we are playing
with the packets.
No, it's not being routed to our machine when sniffing network packets as routing takes place on, again, layer 3 of the OSI model.
In a switched environment without having access to the management interfaces of the switches you can capture network packets while performing ARP cache poisoning.
ARP cache poisoning takes place on layer 2 of the OSI model, called the data link layer. ARP cache poising is a technique where a malicious user floods the network with spoofed frames.
By doing so it tells every or a specific node on the network that, for example, the gateway address is the address is the attacker's machine.
In return the malicious user will sent the data stream to the real gateway while intercepting traffic.
As the question does not clearly states what kind of session hijacking is being talked about I'll "assume" it's about application based session hijacking.
In application based session hijacking a malicious user tries to retrieve
a user's legitimate session identifier. This is usually stored in a session cookie.
By stealing an active and valid session cookie, the malicious user can "ride the session" and is able to whatever the legitimate user can do within the system.
There are several ways to do this from an application perspective:
- Session Fixation
In a session fixation attack, the malicious user set a predefined session identifier on the user's browser.
This can be achieved by sending the users an email with a link containing this predefined session identifier.
- Cross Site Scripting
If a web application does not or does not properly perform input validation and does not properly secure the session cookie with the HTTPOnly attribute, it is possible to steal session cookies.
Injecting a specific payload in the application (reflected or persistent) will sent the session cookie information to the malicious user's cookie stealer.
There are other methods of obtaining session identifiers that are not application related, think of:
- Session Sidejacking (Google it!)
I believe the answer of the question should be Network Layer
From an attacking perspective, I think the proper answer should be the Transport Layer and the layers above it, sometimes called the host layers.