<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Password Hashing Audit

## hashcat

### Synopsis

```bash
hashcat -m <mode> -a <attack> <hashfile> [wordlist] [options]
hashcat -b [-m <mode>]
hashcat --identify <hashfile>
```

### Common Hash Modes

| Mode | Algorithm | Speed Class |
|---|---|---|
| 0 | MD5 | Fast |
| 100 | SHA-1 | Fast |
| 1400 | SHA-256 | Fast |
| 3200 | bcrypt | Slow |
| 10900 | PBKDF2-HMAC-SHA256 | Slow |

### Attack Modes

| Mode | Type | Description |
|---|---|---|
| 0 | Dictionary | Straight wordlist attack |
| 1 | Combination | Combine two wordlists |
| 3 | Brute-force | Mask-based generation |

## john (John the Ripper)

### Synopsis

```bash
john [--format=<type>] [--wordlist=<file>] <hashfile>
john --show <hashfile>
```

## Agent Script

```bash
node agent.js identify '$2b$12$LJ3m4ys3Lg...'
node agent.js benchmark -m 3200
node agent.js audit extracted_hashes.txt
node agent.js crack-test hashes.txt -m 3200 -w /usr/share/wordlists/rockyou.txt
```
