# Desktop app

**English** · [Português](pt-BR/interface.md)

The desktop app (Tauri) and the browser version (`sabia ui`) are the same front-end, in `apps/gui/ui/`. Only the transport differs: the desktop app talks to the core through Tauri; in the browser, `sabia-cli` starts a local server on `127.0.0.1` protected by a token generated on the spot.

<p align="center"><img src="img/networks-light-en.png" width="900" alt="Sabiá capturing Wi-Fi frames in monitor mode, showing visible networks with signal bars, channels, security badges and associated clients"></p>

## Screens

- **Interface sidebar:** lists the Wi-Fi interfaces; pick one to work with. The footer has the version and the one-click **update** button.
- **Capture panel:** header with the current mode (managed/monitor), an **animated signal line**, and the **enable monitor mode** and **start capture** buttons.
- **Authorized-use notice**, always in view: use only on your own networks or with authorization; every monitor activation and capture goes into the local audit trail.
- **Networks seen:** live table with SSID, signal bars, channel and a color-coded security badge (open, WEP, WPA/WPA2, WPA3). Row order is stable (arrival order, signal rounded to 4 dBm buckets) so it doesn't shuffle under the cursor as signal fluctuates.
- **Channels view:** interference/overlap scoring per band with a recommended channel.
- **Network detail → Attacks tab:** directional/continuous deauthentication, PMF probing, clientless PMKID hunting, handshake capture (auto-resumes the capture session if it was stopped), cracking (bundled 9.7M-password dictionary, mutation rules, mask brute force), `.hc22000` export, WPS PIN/Pixie Dust, Evil Twin with captive portal (WPA/WPA2-PSK), and — only shown for 802.1X networks — the Enterprise Evil Twin variant that captures credentials automatically. Every action requires the authorized-use checkbox and is logged to the audit trail.
- **Report:** a paginated, printable audit report (cover, table of contents, findings, channel scoring, networks/clients/handshakes, audit trail) previewed in a dialog and printable to PDF from the browser.

<p align="center"><img src="img/attack-light-en.png" width="900" alt="Network detail dialog showing the Attacks tab (deauthentication, handshake capture, cracking, PMF, WPS and Evil Twin)"></p>

## Privilege

Monitor mode and capture require root/admin. On startup, the app elevates automatically (on Linux and macOS it restarts elevated; on Windows, via the manifest). A notice appears while elevation is requested, with a retry option.

## Themes and language

**Auto, Light and Dark** themes and interface in **Portuguese and English**. The system language is detected at start; the choice is saved. The source text is Portuguese and English is applied at runtime (see `apps/gui/ui/i18n.js`).

<p align="center"><img src="img/networks-dark-en.png" width="900" alt="The networks table in the dark theme"></p>

<p align="center"><img src="img/settings-language-en.png" width="420" alt="The Settings dialog with the Language selector set to English"></p>

## About these screenshots

They show the real interface running with synthetic audit data: 7 access points across 2.4 and 5 GHz (covering open, WEP, WPA/WPA2, WPA3 and 802.1X Enterprise), simulated client stations, and captured handshakes. No real third-party network data appears.