A VLAN hopping attack can be launched in one of three ways:
Dynamic Trunking Protocol (DTP) Spoofing
Using a Rogue Switch with Trunking
Double Tagging or Double Encapsulating