TLDR: Always check cookies on a site login and session.

Cookies are a key value pair in the form of name:value and can be used for various purposes. For now, we’ll focus on the session management. Session Management refers to how the server keeps track of the actions performed by a client. Sessions are usually created with the following workflow:

• User sends username and password to the server to authenticate themselves
• Server checks if users details are correct and sets a cookie
• Every time the user performs an action, the browser sends the cookie as part of the request to the server, which then checks to cookie to ensure the user is authorised to perform a particular action

An important note to consider is that cookie values will be encoded from time to time. A browser and server may not be able to interpret particular characters so the value placed in a cookie is encoded when it’s sent and decoded under the hood (at either end).

A fairly common encoding type is Base64 Encoding:

What would an attacker do: an attacker would first try to identify how the cookie are used for session management. Using Burp Suite, they would intercept every request mentioned in the flow above to examine how the server sets the cookie. Common hallmarks of insecure session management include:

• Using a fixed cookie value: If an attacker obtains the cookie value of a user and this cookie value is always the same, then the attacker can use this to gain access to a user's account. The remediation is that cookie values should be randomly regenerated whenever a user authenticates, so even if an attacker obtains this cookie value once, they wouldn’t use it to gain persistent access to users’ tokens.
• Using a predictable value as part of a cookie: if a server creates cookies that use predictable values such as username or numbers, an attacker could just set their own cookie that a server would authenticate as a different user. The remediation to this is to ensure that cookie values are completely random

While you can use Burp Suite to manipulate cookies, you can also use the inspect element features of browsers. Right click anywhere on the browser and click the inspect button (alternatively you can use the Ctrl-Shift-I combination on Windows/Linux or Cmd-Opt-I on Mac):

This will bring up the developer tools console. Once you have this open, select the Application tab on the top and click the cookies button on the left hand side. This will give you a list of all your cookies categorised per website. You can change the name and value of any cookie but double clicking it.

Refresh the page to see changes.