<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Steganography Artifacts

## zsteg

**LSB steganography detection for PNG and BMP files.**

```bash
zsteg image.png                  # Default scan
zsteg -a image.png               # All bit planes and methods
zsteg -b 1 image.png             # LSB only
zsteg -b 1,2 image.png           # First 2 bits
zsteg -E "b1,rgb,lsb" image.png  # Extract specific payload
```

| Flag | Description |
|------|-------------|
| `-a` | Try all known methods |
| `-b` | Bit plane(s) to analyze |
| `-E` | Extract payload for specific method |
| `-v` | Verbose output |

## steghide

**Hide/extract data in JPEG, BMP, WAV, AU files.**

```bash
steghide info image.jpg                         # Show embedded info
steghide extract -sf image.jpg -p "pass" -xf out.bin  # Extract
steghide embed -cf cover.jpg -ef secret.txt -sf stego.jpg -p "pass"
```

| Flag | Description |
|------|-------------|
| `-sf` | Stego file (input) |
| `-cf` | Cover file (for embedding) |
| `-ef` | Embedded file |
| `-xf` | Extracted file output |
| `-p` | Passphrase |
| `-f` | Force overwrite |

## stegseek

**Fast steghide passphrase cracker.**

```bash
stegseek image.jpg /usr/share/wordlists/rockyou.txt
stegseek --crack image.jpg wordlist.txt         # Crack mode
stegseek --seed image.jpg                        # No passphrase
```

## stegcracker

```bash
stegcracker image.jpg /usr/share/wordlists/rockyou.txt
stegcracker image.jpg wordlist.txt -t 8          # 8 threads
```

## binwalk — Appended Data Detection

```bash
binwalk image.jpg                # Scan for embedded components
binwalk -e image.jpg             # Extract embedded files
binwalk -E image.jpg             # Entropy analysis
```

## ExifTool — Metadata Inspection

```bash
exiftool -all image.jpg          # All metadata
exiftool -Comment image.jpg      # Check comment field
exiftool -XMP:all image.jpg      # XMP metadata
```

## SoX — Audio Spectrogram

```bash
sox audio.wav -n spectrogram -o spectrogram.png
sox audio.wav -n spectrogram -x 2000 -y 513 -o spec_detail.png
```

## Python — Chi-Square Test

```python
import numpy as np
from PIL import Image
from scipy import stats

pixels = np.array(Image.open('image.png')).flatten()
even = np.sum(pixels % 2 == 0)
odd = np.sum(pixels % 2 == 1)
chi2, p_value = stats.chisquare([even, odd])
# p_value > 0.95 suggests LSB steganography
```
