Hacking cookies

 If you find some kind of custom cookie containing sensitive data (sessionID, username, emails...) you should definitely try to exploit it.

Decoding the cookie:-

If the cookie is using some Base encoding (like Base64) or similar you may be able to decode it, change the content and impersonate arbitrary users.

Session Hijacking:-

Steal a cookie and use it to impersonate the user inside an application.

Session fixation:-

The attacker get a cookie from a web page and send to the victim a link so the victim logins using the cookie of the attacker. If the cookie is not changed when a user logs in, this could be useful because the attacker could be able to impersonate the user using the cookie.