If you're interested in a hands on demonstration, Twitter is a very good example of how easily it's done. You'll need:
- Two Computers
- Firefox with Firebug (obviously there are other options, but these are popular and easy to get)
- A Cookie Editor, like Advanced Cookie Manager (again, easily installable add-on through Firefox)
On computer A with firefox and firebug, log in to your twitter account on the non-https site. Once logged in, open up Firebug and look at the "GET twitter.com" line. When you expand it look under the Response Headers section and find Set-Cookie. In there you'll find a cookie called _twitter_sess. Highlight and copy the value (all the way until the semi-colon).
Now open up Firefox with the advanced cookie manager on computer B and go to the twitter login page. Open the Advanced Cookie Manager and filter for twitter.com. Once you find the twitter.com domain and its list of cookies, you'll see a cookie called _twitter_sess. Delete it. Now make a new cookie with the name "_twitter_sess", path "/" and "Value" the value of _twitter_sess from the other computer. Save the cookie.
Now close the cookie manager and go back to the twitter login page, refresh the page and bam, you're in.
Now just devise some clever way to get someone else's session (open wifi, xss) and that's one way of how session hijacking is done.