# Roadmap

**English** · [Português](ROADMAP.pt-BR.md)

Sabiá does Wi-Fi auditing: it discovers networks, captures handshakes (4-way and PMKID), cracks WPA/WPA2-PSK by dictionary/rules/mask, assesses WPS, PMF and evil twin exposure, and tests deauthentication and rogue-AP attacks with authorization. Always for authorized use, with a local audit trail.

## Done (1.0.0)

- **Monitor mode** and channel control via netlink/`iw`, with automatic recovery from NetworkManager reclaiming the interface.
- **Scanning** of 2.4, 5 and 6 GHz: APs and clients, with SSID, BSSID, channel, signal, security, WPS details, vendor and PHY standard.
- Raw 802.11 capture via **AF_PACKET** (no libpcap), **radiotap** and management-frame parsing.
- Capture of the **4-way handshake (EAPOL)** and the **PMKID**; **CCMP traffic decryption** once the password is known.
- **Offline cracking** (PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK: a 9.7M-password dictionary (rockyou + Probable-Wordlists) by default, hashcat-style **mutation rules** and **mask brute force**.
- **`.hc22000` export** to take the handshake straight to hashcat/John.
- **`.pcap`** read and write; offline `.pcap` analysis.
- Authorized **`deauth`** (`--yes` flag), directional and continuous jobs, PMF probing, clientless PMKID hunting.
- **WPS attack** (PIN/Pixie Dust) via a bundled reaver, or bully when installed.
- **Evil Twin** with captive portal for WPA/WPA2-PSK (password only accepted after cryptographic verification against the real handshake) and a credential-capture variant for WPA2/WPA3-Enterprise (802.1X/EAP).
- Channel-interference scoring and security findings (open network, no PMF, WPS exposed, possible evil twin).
- Redesigned, paginated **audit report** (cover, table of contents, running header/footer) that prints to PDF from the browser.
- Local hash-chained **audit trail**; `doctor` diagnostics.
- **CLI** + **desktop app** (Tauri) + local UI server; **one-click update**.

## Next

- **GPU** acceleration for PMK derivation.
- **Capture on Windows** via Npcap.

## Later

- **WPA3/SAE**: detection and downgrade paths where applicable.
- Validation on **varied hardware** (chipsets and regulatory domains).
- Signing of release binaries (SmartScreen/Gatekeeper).

## Long term

- GPU-accelerated cracking backend (hashcat integration beyond export).
- Packaged distribution (`apt`/`brew`/winget).