Session ID

What is session ID?

A session ID is a unique number that a Web site's server assigns a specific user for the duration of that user's visit (session). The session ID can be stored as a cookie, form field, or URL (Uniform Resource Locator).

Where session ID stores?

The server allocates a session and stores its ID in a cookie, known as the session cookie. The ASP Session cookie has this format:-

ASPSESSIONIDACSSDCCC=APHELKLDMNKNIOJONJACDHFN

Note that last 8 characters in the name of the cookie will vary from one instance of your application to the next. Hence to even discover the cookie you need to enumerate all the cookies looking for any that match the pattern ASPSESSIONIDxxxxxxxx.

I'm not sure what you could usefully do with this cookie once you have acquired it.

Where session ID is stored if cookie is disabled? 

If you want to disable the use of cookies in your ASP.NET application and still make use of session state, you can configure your application to store the session identifier in the URL instead of a cookie by setting the cookieless attribute of the sessionState configuration element to true, or to UseUri, in the Web.config file for your application.
The following code example shows a Web.config file that configures session state to use cookieless session identifiers.

cookieless="true"
regenerateExpiredSessionId="true"
timeout="30" />