But you can either guess the session ID or, the server is setup correctly ride along one (can't remember the exact name) : some server accept parameters like SESSID=blabla to give a session ID if your PC don't accept cookies.
- so, get yourself a session ID, you'll have a page like index.php?SESSIONID=ab8e43c8...
- refresh it like every 5 mn
- give the link to this page to someone who has an account on it
- as you give it with a session ID, the guy has now the same session you have
- wait for him to log in
- sharing the same session, you just hijacked his. It's time to change some password now.

The way to protect from that in php is simple : session_regenerate_id everytime a user log in or out of one of your apps. If you have a special admin page : samething, ask for the password again and regenerate the session ID.

[Linked Image from w3.the-kgb.com][Linked Image from w3.the-kgb.com]