What information can an attacker steal using XSS?

By using XSS, the session id of the genuine user can be stolen by the attacker. The session id is used by the browser to identify your credentials in an application and helps you keep login till sign off from an application. An attacker can write a code to extract information from cookies which contain session id and other information. Later, same session id can be used by an attacker to browse the application on behalf of the user without actually logged in the application.