Get on the same WiFi as your target, open up Wireshark and grab their HTTP communications.
To make this easier, there was/is a tool called Firesheep that can be used to hijack session cookies. The popularity of Firesheep caused many sites to enable HTTPS by default (e.g. Facebook did so).
