As part of some basic pen-testing I've been invited to do on a live site, I've managed to access other users' cookies.
The first thing that springs to mind that could be used to demonstrate the extent of this vulnerability would be to hijack the session. However, I'm struggling to identify which part of the cookie is used to uniquely identify the session. Can I expect to see just one session ID field? There are many (arguably too many) different components of the cookie for their site, and multiple of these fields differ from session to session (I've logged in with 2 fake accounts).
I've tried a few ways of setting these cookies ('edit this cookie' in chrome and 'firebug' in firefox) but when I refresh the page - I'm not logged in.
Or is this rather subjective and specific to the site?
To add some clarity to my question, I'm looking for an example of how I can switch session using the tools I've mentioned above (maybe you can give me an example of how I can do this myself on a well-known site given a session ID from one browser used in another?).
Furthermore, more importantly, it'd be great if you could give me an insight into how a pen-tester may identifier the part of the cookie responsible for session identification.
EDIT
One of the things that's complicating it further is what I have access to in document.cookie. Fire up dev tools for this page, have a look at document.cookie, stackexchange doesn't appear to keep the session ID in there. But if I look at the storage options in dev tools, it's in there. That's fine - but how might an XSS attack access this client-side? On further reading, this seems to be a HttpOnly cookie - so then this is a guard against XSS is it? So if my target site employed this, it would not be vulnerable?