How Cookies can be a threat?

Cookies could be used to store session IDs. There are two types of cookies: persistent and nonpersistent. A persistent cookie is stored on the client's hard drive, and an attacker who has access to the client machine can easily access the cookie. A nonpersistent cookie is stored in memory and is more difficult to access.
With the help of special programs called sniffers, cookies can also pulled off the wire as they travel between the client and the server. Another attack is to guess a cookie. An attacker can visit an e-commerce site numerous times and get an idea of session IDs and cookie values. If the attacker successfully guesses a cookies, he or she can impersonate a valid user and gain access to the users account.
To make the guessing of cookies difficult, session IDs must be unique long numbers. If a session ID is serially incremented or if it follows a specific time pattern, an attacker can generate an identifier that coincides with the identifiers of a current user.