> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/network-pentesting/wireshark.md).

# Wireshark

## Search by string in Wireshark

1. Navigate to `Edit` -> `Find Packet`
2. Left-click on `Packet list` and then click `Packet bytes`
3. Select `String` on the third drop-down menu and specify `auth-session` on the field next to it. Finally, click `Find`. Wireshark will present you with the packets that include an `auth-session` string.
4. The cookie can be copied by right-clicking on a row that contains it, then clicking on `Copy` and finally clicking `Value`.