Analyzing Proxychains Traffic on the Pentest Scenario: Enhancements in Network Forensics through Wireshark

This study proposed to enhance network forensics capabilities in detecting and investigating malicious anonymous actions with Wireshark to analyze proxychains traffic that is often carried out by anonymous attackers to hide their identity not revealed. This work can be implemented in cyber investigations and contribute to the advancement of network forensic techniques. Proxychains are tools used by some cybercriminals to redirect network traffic through several proxy servers so that attacks are carried out anonymously and the attacker's IP is one of the greatest challenges to track. This research is carried out and focuses on analyzing the extent to which proxychains can hide the identity of the attacker's IP. This research aims to prove the anonymity of using proxychains and find out the extent of tracing that can be done to track the real attacker's IP conducted by analyzing the PCAP using Wireshark obtained from capturing traffic of information gathering and scanning scenarios on the Pentest phase. The research result shows the method used to gather evidence during forensic investigations of proxy use which show to what extent proxies hide the identity of users.