As part of some basic pen-testing I've been invited to do on a live site, I've managed to access other users' cookies.

The first thing that springs to mind that could be used to demonstrate the extent of this vulnerability would be to hijack the session. However, I'm struggling to identify which part of the cookie is used to uniquely identify the session. Can I expect to see just one session ID field? There are many (arguably too many) different components of the cookie for their site, and multiple of these fields differ from session to session (I've logged in with 2 fake accounts).

I've tried a few ways of setting these cookies ('edit this cookie' in chrome and 'firebug' in firefox) but when I refresh the page - I'm not logged in.

Or is this rather subjective and specific to the site?