XSS and URL Encoded Session IDs

Hi List,

recently I did my first "real" WebApp Audit, so I´m quite new to this topic. The application in case has lot´s of XSS Vulnerabilities, but they are only accessible if you already know the SessionID of a specific user. Example

https://somesite.com/bad.asp?SID=4243434234234234?ID=<xss string of choice>

As you may have noticed the site is only accessible via HTTPS. So how to craft an URL which will trigger the XSS ? Don´t I have to know the SessionID first?

The only thing I can think of is to exploit a client side vuln. to get the SID.

Any better ideas?

BF