ciberfauna/sabia
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

v0.1.0: logo, i18n pt/en, CI com caches, testes e documentação

Browse Source 
- Logo oficial (sabia.png) e conjunto de ícones do app desktop.
- Interface em português e inglês: tradutor por observação do DOM, seletor
  de idioma e checagem de cobertura de tradução no CI.
- CI/CD com caches (rust-cache, .deb do Tauri em cache) e pipeline de release
  multiplataforma (CLI em 5 alvos + app desktop via tauri-action), templates
  de issue/PR.
- Suíte de testes de integração do sabia-core (scan e2e, handshake/crack
  4-way e PMKID, pcap, trilha de auditoria) — 46 testes verdes.
- Documentação completa pt/en: README, ROADMAP, SECURITY, CONTRIBUTING,
  CHANGELOG e docs/ (cli, interface, arquitetura), com enquadramento de uso
  autorizado.
- Correções de clippy (-D warnings) e formatação em toda a árvore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Lucas RayanandClaude Opus 5.5 committed 2026-10-23 12:46:19 -03:00
1 parent df27974359
commit 791538c9d9
112 files changed
+15620 -494
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

crates/sabia-cli/src/main.rs
+395 -104
View File
@@ -1,9 +1,9 @@
mod web;
use clap::{Parser, Subcommand};
use sabia_core::{
audit::AuditLog, capture::RawCapture, iface, netlink, pcapwriter::PcapWriter, scan::ScanTable,
};
use sabia_core::engine::{Engine, ScanOptions};
use sabia_core::iface;
use std::io::IsTerminal;
use std::path::PathBuf;
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::Arc;
@@ -16,47 +16,115 @@ use std::time::Duration;
version
)]
struct Cli {
/// Trilha de auditoria (padrão: .sabia-audit.log).
#[arg(long, global = true, default_value = ".sabia-audit.log")]
audit: PathBuf,
#[command(subcommand)]
cmd: Cmd,
}
#[derive(Subcommand)]
enum Cmd {
/// Lista interfaces de rede e mostra quais são Wi-Fi.
/// Lista interfaces, canais e controla o modo monitor.
Iface {
#[command(subcommand)]
action: IfaceAction,
},
/// Varre o ar na interface (já em modo monitor) e mostra APs/clientes vistos.
/// Captura o ar e mostra redes, clientes e handshakes.
Scan {
iface: String,
/// Canal fixo; sem isso, pula entre todos os canais suportados.
/// Canal fixo; sem isso, percorre os canais suportados.
#[arg(long)]
channel: Option<u32>,
/// Banda ao percorrer canais: 2.4, 5, 6 ou all.
#[arg(long)]
band: Option<String>,
/// Tempo em cada canal (ms).
#[arg(long, default_value_t = 350)]
hop_ms: u64,
/// Para a varredura depois de N segundos (padrão: até Ctrl+C).
#[arg(long)]
seconds: Option<u64>,
/// Salva tudo que foi capturado em um .pcap (inclui handshakes).
/// Salva os quadros capturados em um .pcap.
#[arg(long)]
out: Option<PathBuf>,
/// Depois de capturar, tenta quebrar o primeiro handshake.
#[arg(long, value_name = "DICIONARIO")]
crack: Option<PathBuf>,
/// Mostra apenas o JSON final.
#[arg(long)]
json: bool,
},
/// Analisa um .pcap offline (redes, clientes e handshakes).
Analyze {
pcap: PathBuf,
#[arg(long)]
json: bool,
},
/// Quebra um handshake de um .pcap por dicionário.
Crack {
pcap: PathBuf,
/// Dicionário com uma senha por linha.
#[arg(short, long)]
wordlist: PathBuf,
#[arg(long)]
bssid: Option<String>,
#[arg(long)]
station: Option<String>,
#[arg(long)]
json: bool,
},
/// Envia desautenticação para um AP/estação (teste autorizado).
Deauth {
iface: String,
#[arg(long)]
bssid: String,
/// Sem isso, o destino é broadcast.
#[arg(long)]
station: Option<String>,
#[arg(long, default_value_t = 5)]
count: u32,
#[arg(long, default_value_t = 7)]
reason: u16,
/// Confirma que você tem autorização para testar esta rede.
#[arg(long)]
yes: bool,
},
/// Diagnóstico de privilégios, ferramentas e interfaces.
Doctor {
#[arg(long)]
json: bool,
},
/// Inspeciona a trilha de auditoria.
Audit {
#[command(subcommand)]
action: AuditAction,
},
/// Verifica e aplica atualizações do próprio sabia.
Update {
#[arg(long)]
apply: bool,
},
/// Confere a integridade da trilha de auditoria.
AuditVerify { path: PathBuf },
/// Abre a interface gráfica (servidor local + navegador).
Ui {
#[arg(long, default_value = "4337")]
port: u16,
/// Não tenta abrir o navegador automaticamente.
#[arg(long)]
no_open: bool,
},
}
#[derive(Subcommand)]
enum IfaceAction {
List,
/// Mostra os canais suportados pelo rádio.
Channels {
iface: String,
#[arg(long)]
json: bool,
},
/// Liga/desliga modo monitor numa interface Wi-Fi.
Monitor {
iface: String,
@@ -65,16 +133,23 @@ enum IfaceAction {
},
}
#[derive(Subcommand)]
enum AuditAction {
/// Confere a integridade da cadeia.
Verify { path: Option<PathBuf> },
/// Mostra as últimas entradas.
Show {
#[arg(long, default_value_t = 20)]
limit: usize,
},
}
#[derive(Clone, Copy, clap::ValueEnum)]
enum OnOff {
On,
Off,
}
fn audit_path() -> PathBuf {
PathBuf::from(".sabia-audit.log")
}
fn main() {
let cli = Cli::parse();
if let Err(e) = run(cli) {
@@ -84,6 +159,9 @@ fn main() {
}
fn run(cli: Cli) -> sabia_core::Result<()> {
let audit_path = cli.audit.clone();
let engine = Engine::with_audit_path(&audit_path);
match cli.cmd {
Cmd::Iface { action } => match action {
IfaceAction::List => {
@@ -94,17 +172,33 @@ fn run(cli: Cli) -> sabia_core::Result<()> {
i.name,
i.mac,
tag,
format!("{:?}", i.mode),
format!("{:?}", i.mode).to_lowercase(),
if i.up { "up" } else { "down" }
);
}
}
IfaceAction::Channels { iface: name, json } => {
let channels = engine.channels(&name)?;
if json {
println!("{}", serde_json::to_string_pretty(&channels)?);
} else {
for c in channels {
println!(
"canal {:<4} {:>5} MHz {:<6} {}{}",
c.channel,
c.freq_mhz,
c.band.label(),
if c.disabled { "desabilitado" } else { "ok" },
c.max_power_dbm
.map(|p| format!(" até {p:.1} dBm"))
.unwrap_or_default()
);
}
}
}
IfaceAction::Monitor { iface: name, state } => {
let enable = matches!(state, OnOff::On);
iface::get(&name)?; // valida que é Wi-Fi antes de tocar nela
netlink::set_monitor_mode(&name, enable)?;
let mut log = AuditLog::open(audit_path())?;
log.record("monitor_mode", &name, &format!("{{\"enable\": {enable}}}"))?;
engine.set_monitor(&name, enable)?;
println!(
"{name}: modo monitor {}",
if enable { "ativado" } else { "desativado" }
@@ -115,104 +209,167 @@ fn run(cli: Cli) -> sabia_core::Result<()> {
Cmd::Scan {
iface: name,
channel,
band,
hop_ms,
seconds,
out,
crack,
json,
} => {
let info = iface::get(&name)?;
if info.mode != iface::Mode::Monitor {
eprintln!("aviso: {name} não está em modo monitor (sabia iface monitor {name} on)");
}
let mut log = AuditLog::open(audit_path())?;
log.record(
"scan_start",
&name,
&format!("{{\"channel\": {channel:?}}}"),
)?;
let cap = RawCapture::open(&name)?;
cap.set_read_timeout(Duration::from_millis(500))?;
let options = ScanOptions {
channel,
band,
hop_ms,
pcap_out: out,
duration_secs: seconds,
};
engine.start_scan_with(&name, options)?;
let running = Arc::new(AtomicBool::new(true));
let r = running.clone();
ctrlc::set_handler(move || r.store(false, Ordering::SeqCst))
.expect("falha ao instalar handler de Ctrl+C");
let _ = ctrlc::set_handler(move || r.store(false, Ordering::SeqCst));
let mut table = ScanTable::new();
let mut writer = match &out {
Some(p) => Some(PcapWriter::create(p)?),
None => None,
};
let channels: Vec<u32> = match channel {
Some(c) => vec![c],
None => netlink::supported_channels(&name).unwrap_or_default(),
};
let mut chan_idx = 0usize;
let mut last_hop = std::time::Instant::now();
let deadline = seconds.map(|s| std::time::Instant::now() + Duration::from_secs(s));
let mut buf = [0u8; 65535];
println!("capturando em {name}... (Ctrl+C para parar)");
let interactive = std::io::stdout().is_terminal() && !json;
while running.load(Ordering::SeqCst) {
if let Some(d) = deadline {
if std::time::Instant::now() >= d {
break;
}
std::thread::sleep(Duration::from_secs(1));
let snapshot = match engine.scan_snapshot(&name) {
Ok(s) => s,
Err(_) => break,
};
if !snapshot.running {
break;
}
if channel.is_none()
&& !channels.is_empty()
&& last_hop.elapsed() > Duration::from_millis(300)
{
chan_idx = (chan_idx + 1) % channels.len();
let _ = netlink::set_channel(&name, channels[chan_idx]);
last_hop = std::time::Instant::now();
}
match cap.recv(&mut buf)? {
Some(n) => {
let frame = &buf[..n];
let had_eapol = table.ingest(frame);
if had_eapol {
eprintln!("[!] handshake EAPOL visto");
}
if let Some(w) = writer.as_mut() {
w.write_frame(frame)?;
}
}
None => continue, // timeout, sem quadro
if interactive {
print!("\x1b[2J\x1b[H");
print_snapshot(&snapshot);
}
}
if let Some(w) = writer.as_mut() {
w.flush()?;
engine.stop_scan(&name);
let snapshot = engine.scan_snapshot(&name)?;
if json {
println!("{}", serde_json::to_string_pretty(&snapshot)?);
} else {
if interactive {
print!("\x1b[2J\x1b[H");
}
print_snapshot(&snapshot);
}
log.record(
"scan_stop",
&name,
&format!("{{\"aps_found\": {}}}", table.access_points().len()),
if let Some(wordlist) = crack {
crack_first(&engine, &name, &wordlist)?;
}
}
Cmd::Analyze { pcap, json } => {
let snapshot = engine.analyze_pcap(&pcap)?;
if json {
println!("{}", serde_json::to_string_pretty(&snapshot)?);
} else {
print_snapshot(&snapshot);
}
}
Cmd::Crack {
pcap,
wordlist,
bssid,
station,
json,
} => {
let mut last = 0u64;
let report = sabia_core::crack::crack_pcap(
&pcap,
&wordlist,
bssid.as_deref(),
station.as_deref(),
|tried| {
if tried.saturating_sub(last) >= 4096 {
eprint!("\r{tried} senhas testadas…");
last = tried;
}
},
)?;
println!(
"\n{:<18} {:<24} {:<8} {:<8} {:<6} CLIENTES",
"BSSID", "SSID", "CANAL", "SINAL", "SEG"
);
for ap in table.access_points() {
if !json {
eprintln!();
}
if json {
println!("{}", serde_json::to_string_pretty(&report)?);
} else if let Some(password) = &report.password {
println!(
"{:<18} {:<24} {:<8} {:<8} {:<6} {}",
ap.bssid,
ap.ssid.unwrap_or_default(),
ap.channel.map(|c| c.to_string()).unwrap_or_default(),
ap.last_signal_dbm
.map(|s| format!("{s}dBm"))
.unwrap_or_default(),
ap.security.unwrap_or_default(),
ap.clients.len()
"SENHA ENCONTRADA: {password}\n{} tentativas em {} ms ({})",
report.tried,
report.elapsed_ms,
report.method.as_deref().unwrap_or("?")
);
} else {
println!(
"senha não encontrada ({} tentativas em {} ms)",
report.tried, report.elapsed_ms
);
}
}
Cmd::Deauth {
iface: name,
bssid,
station,
count,
reason,
yes,
} => {
if !yes {
return Err(sabia_core::SabiaError::InvalidInput(
"desautenticação derruba clientes; confirme com --yes apenas em rede própria ou com autorização".into(),
));
}
let report = engine.deauth(&name, &bssid, station.as_deref(), count, reason)?;
println!(
"{} quadros enviados para {} via {} (motivo {})",
report.frames_sent, report.station, report.iface, report.reason
);
}
Cmd::Doctor { json } => {
let report = engine.doctor();
if json {
println!("{}", serde_json::to_string_pretty(&report)?);
} else {
print_doctor(&report);
}
}
Cmd::Audit { action } => match action {
AuditAction::Verify { path } => {
let path = path.unwrap_or_else(|| audit_path.clone());
if !path.exists() {
println!(
"{} não existe (nenhuma ação registrada ainda)",
path.display()
);
} else {
match sabia_core::audit::AuditLog::verify(&path)? {
None => println!("cadeia de auditoria íntegra ({})", path.display()),
Some(idx) => {
println!("cadeia ROMPIDA na entrada {idx} ({})", path.display())
}
}
}
}
AuditAction::Show { limit } => {
let entries = sabia_core::audit::AuditLog::read_entries(&audit_path, Some(limit))?;
if entries.is_empty() {
println!("nenhuma entrada em {}", audit_path.display());
}
for e in entries {
println!(
"{} {:<18} {:<18} {}",
e.timestamp, e.action, e.target, e.detail
);
}
}
},
Cmd::Update { apply } => {
let current = env!("CARGO_PKG_VERSION");
if apply {
@@ -233,14 +390,148 @@ fn run(cli: Cli) -> sabia_core::Result<()> {
}
}
Cmd::AuditVerify { path } => match sabia_core::audit::AuditLog::verify(&path)? {
None => println!("cadeia de auditoria íntegra"),
Some(idx) => println!("cadeia ROMPIDA na entrada {idx}"),
},
Cmd::Ui { port } => {
web::serve(port)?;
Cmd::Ui { port, no_open } => {
web::serve(port, audit_path, !no_open)?;
}
}
Ok(())
}
fn crack_first(engine: &Engine, iface: &str, wordlist: &PathBuf) -> sabia_core::Result<()> {
let Some(hs) = engine
.handshakes(Some(iface))
.into_iter()
.find(|h| h.crackable)
else {
println!("\nnenhum handshake quebrável capturado");
return Ok(());
};
println!(
"\nquebrando handshake de {} ({}) com {}…",
hs.ssid.as_deref().unwrap_or("?"),
hs.bssid,
wordlist.display()
);
let id = engine.start_crack(iface, Some(&hs.bssid), Some(&hs.station), wordlist)?;
loop {
let job = engine.crack_job(&id).expect("job");
if job.status == "running" {
eprint!("\r{} senhas testadas…", job.tried);
std::thread::sleep(Duration::from_millis(500));
continue;
}
eprintln!();
match job.report {
Some(report) => match report.password {
Some(password) => println!(
"SENHA ENCONTRADA: {password}\n{} tentativas em {} ms",
report.tried, report.elapsed_ms
),
None => println!(
"senha não encontrada ({} tentativas em {} ms)",
report.tried, report.elapsed_ms
),
},
None => println!("falha: {}", job.error.unwrap_or_default()),
}
break;
}
Ok(())
}
fn print_snapshot(snapshot: &sabia_core::scan::ScanSnapshot) {
println!(
"{} {}{} {} quadros · {} APs · {} clientes · {} handshakes",
snapshot.iface,
if snapshot.running { "● " } else { "" },
snapshot
.channel
.map(|c| format!("canal {c}"))
.unwrap_or_default(),
snapshot.stats.frames,
snapshot.stats.aps,
snapshot.stats.clients,
snapshot.stats.handshakes
);
if !snapshot.access_points.is_empty() {
println!(
"\n{:<18} {:<24} {:<6} {:<8} {:<12} CLIENTES",
"BSSID", "SSID", "CANAL", "SINAL", "SEGURANÇA"
);
for ap in &snapshot.access_points {
println!(
"{:<18} {:<24} {:<6} {:<8} {:<12} {}",
ap.bssid,
ap.ssid.clone().unwrap_or_else(|| "<oculta>".into()),
ap.channel.map(|c| c.to_string()).unwrap_or_default(),
ap.signal_dbm
.map(|s| format!("{s} dBm"))
.unwrap_or_default(),
ap.security.clone().unwrap_or_default(),
ap.clients.len()
);
}
}
if !snapshot.handshakes.is_empty() {
println!("\nHANDSHAKES");
for hs in &snapshot.handshakes {
println!(
"{:<18} {:<18} {:<16} msgs {:<8} {}{}",
hs.bssid,
hs.station,
hs.ssid.clone().unwrap_or_default(),
hs.messages,
hs.kind,
if hs.crackable { " · quebrável" } else { "" }
);
}
}
}
fn print_doctor(report: &sabia_core::doctor::DoctorReport) {
println!("Sabiá {} ({})", report.version, report.platform);
println!(
"root: {} · iw: {} · ip: {} · curl: {} · captura: {}",
yes_no(report.root),
yes_no(report.iw),
yes_no(report.ip),
yes_no(report.curl),
report.capture_backend
);
println!(
"auditoria: {} ({})",
report.audit_path,
if report.audit_ok {
"íntegra"
} else {
"corrompida"
}
);
if !report.interfaces.is_empty() {
println!("\nINTERFACES");
for i in &report.interfaces {
println!(
"{:<16} {:<18} {:<10} monitor: {:<3} driver: {}",
i.name,
i.mac,
i.mode,
yes_no(i.monitor_supported),
i.driver.as_deref().unwrap_or("?")
);
}
}
if !report.notes.is_empty() {
println!("\nAVISOS");
for note in &report.notes {
println!("- {note}");
}
}
}
fn yes_no(value: bool) -> &'static str {
if value {
"sim"
} else {
"não"
}
}