security - Session Hijacking in practice -

I recently read on session fixing / abduction, and understand the principle.

I do not understand how this behavior will be exploited. Do you have to tinkle with your browser to use the stolen cookies? Pass it on the web application by adding it to the URL?

Or would you write some types of custom scripts to use it, and if so what will happen?

I am not trying to ask for help with this or examples, but I am trying to learn more and understand. Any help is appreciated.

Installing a cookie is trivial as mentioned by Klaus, Can do the way.

The practical example of this is how it might be advantageous:

• You enter your banking site
• The banking site is a session ID Puts in a cookie, 123456 says
• Your browser sends session IDs to the server on each request. The server appears on your session store and recognizes you as a user who was logged in a while ago
• I access some of my cookies in any way, or I will request a copy of your HTTP requests (SSL I will make a cookie for your banking site, which will have a session ID
• The banking site recognizes me, Still logged in
• I transfer all my money into my secret account in Switzerland and buy a ridiculous big boat

Of course, high profile sites will have more security (for example, anyone can check That a session ID is never transferred to other client IP addresses), but this is the essence of how the session hijacking works.