was wondering if she sent an image to her friend or something, it'd register in Wireshark as JSON protocol, or HTTP or something
That depends on how she sends it. If it's sent over Wi-Fi, and it's not a "protected" Wi-Fi network (WEP, WPA, etc.), and it's not sent using some version of SSL/TLS, then it'd show up as whatever protocol was used - HTTP, with some if that's what's being used, or maybe some messaging protocol. If it's HTTP, then there will be a payload in a PUT or POST request; Wireshark doesn't directly support displaying the payload as an image if it's in an image format (JPEG, etc.), but you could save it to a file and open it.
If it's on a "protected" Wi-Fi network, however, you will either need the password for the network - and, if it's WPA or later, you will need to capture traffic as her phone/tablet/laptop joins the network - in order to decrypt the encrypted Wi-Fi packets, or you'll need a tool to crack the network traffic.
And if it's being sent using some version of SSL/TLS, you'll need additional information to decrypt that traffic, or you'll need a tool to crack that.
