# What Sabiá supports

[English](support.md) · [Português](pt-BR/suporte.md)

Matrix of what exists today (version 1.0.3). For what comes next, see the [ROADMAP](../ROADMAP.md).

## Platforms

| | Discovery and capture | Offline analysis and cracking | Desktop app |
|---|---|---|---|
| Linux | ✅ root, adapter in monitor mode | ✅ | ✅ AppImage and deb |
| Windows | ❌ | ✅ `.pcap`, wordlist/rules/mask | ✅ installer |
| macOS | ❌ | ✅ `.pcap`, wordlist/rules/mask | ❌ no build |

Live capture uses `AF_PACKET` and netlink; it needs Linux, root (or `CAP_NET_ADMIN`/`CAP_NET_RAW`) and an adapter that supports monitor mode. Injection (`deauth`, Evil Twin) needs an adapter that also supports injection. The desktop app asks for elevation on startup.

## Discovery

- **2.4, 5 and 6 GHz** channel sweep, limited by the adapter and the regulatory domain.
- **Access points and clients** with SSID, BSSID, channel, signal, security type, WPS details and vendor.
- **Monitor mode** on/off through netlink/`iw`, with automatic recovery if NetworkManager takes the interface back.
- **Supported channels** reported per radio.

## Capture and analysis

| Item | Support |
|---|---|
| 4-way handshake (EAPOL) | ✅ detected and stored for offline cracking |
| PMKID | ✅ detected and stored, including clientless PMKID hunting |
| `.pcap` write and read | ✅ compatible with other 802.11 tools |
| CCMP decryption | ✅ for a client whose PSK is already known |
| Radiotap / 802.11 / EAPOL parsing | ✅ |

## Cracking (WPA/WPA2-PSK)

| Mode | Support |
|---|---|
| Dictionary | ✅ rockyou + Probable-Wordlists by default (9.7 million passwords) |
| Mutation rules | ✅ hashcat-style rules |
| Mask/brute force | ✅ `?d?l?u?s?a` |
| Verification | ✅ PBKDF2-HMAC-SHA1 PMK + MIC (4-way) or PMKID |
| Export | ✅ `.hc22000` for hashcat/John |

WPA3/SAE does **not** fall to a handshake dictionary attack; the cracking scope is WPA/WPA2-PSK.

## Authorized attacks

- **Deauthentication** directed or continuous, with `--yes` / explicit authorization checkbox.
- **PMF test** and **clientless PMKID hunt**.
- **WPS PIN / Pixie Dust** using the bundled `reaver` (GPL-2) or `bully` when installed.
- **Evil Twin PSK**: clones a seen AP with a captive portal; the password is only accepted after being checked against the real captured handshake.
- **Evil Twin Enterprise** (802.1X/EAP): captures credentials automatically, without a portal. It needs `hostapd-wpe` and a second Wi-Fi interface in AP mode.

## Reports, audit and diagnostics

- **Paginated audit report** (cover, table of contents, findings, channel score, audit trail), generated locally.
- **Hash-chained audit trail** for every monitor-mode activation and capture session (`sabia audit show`).
- **`sabia doctor`** checks privileges, tools and interfaces before capture.

## What Sabiá does not do

- Crack WPA3/SAE handshakes, or recover a password without a captured handshake/PMKID and a matching candidate.
- Capture on Windows or macOS; those platforms are offline analysis only.
- Bypass the authorization requirement for deauth, WPS or Evil Twin.
- Guarantee 5/6 GHz coverage: it depends on the adapter, regulatory domain and driver.
- Make an enterprise client trust a self-signed certificate when the client validates the chain (common in managed corporate profiles).
- Provide GPU acceleration yet; cracking is CPU-bound.