# Terminal (`sabia`)

**English** · [Português](pt-BR/cli.md)

The `sabia` binary has the global option `--audit <file>` (audit trail; default `.sabia-audit.log`) and the commands below. Capture and monitor mode require Linux and root; analysis and cracking run on any platform.

## `iface` — interfaces and monitor mode

```bash
sabia iface list                    # Wi-Fi interfaces and their modes
sabia iface channels <iface>        # channels the radio supports  [--json]
sudo sabia iface monitor <iface> on # enable monitor mode (on|off)
```

## `scan` — capture the air

```bash
sudo sabia scan <iface> [options]
```

| Option | Effect |
|---|---|
| `--channel <n>` | Fix a channel (without it, hops across the supported ones). |
| `--band <2.4\|5\|6\|all>` | Band when hopping channels. |
| `--hop-ms <ms>` | Time on each channel (default 350). |
| `--seconds <n>` | Stop after N seconds (default: until Ctrl+C). |
| `--out <file.pcap>` | Save captured frames. |
| `--crack <dictionary>` | After capturing, try to crack the first handshake. |
| `--json` | Print only the final JSON. |

Shows networks (APs), clients and handshakes seen (4-way and PMKID).

## `analyze` — read a `.pcap` offline

```bash
sabia analyze <file.pcap> [--json]
```

## `crack` — dictionary cracking

```bash
sabia crack <file.pcap> --wordlist <list.txt> [--bssid <mac>] [--station <mac>] [--rules] [--json]
```

Recomputes the PMK with PBKDF2-HMAC-SHA1 and checks the MIC (4-way) or the PMKID, for WPA/WPA2-PSK. `--bssid`/`--station` filter which handshake to use. `--rules` applies hashcat-style mutations (uppercase, numeric/symbol suffixes, simple leet) to each dictionary word — multiplies the time for real. The desktop app and `sabia ui` additionally offer the bundled 9.7M-password dictionary by default, mask brute force (`?d?l?u?s?a`), and `.hc22000` export.

## `deauth` — authorized deauthentication test

```bash
sudo sabia deauth <iface> --bssid <mac> [--station <mac>] [--count 5] [--reason 7] --yes
```

Without `--station`, the target is broadcast. The **`--yes`** flag confirms you are authorized to test this network — without it, the command refuses. It is recorded in the audit trail.

## `doctor` — diagnostics

```bash
sabia doctor [--json]
```

Checks privileges, tools (`iw`, `ip`) and monitor-capable interfaces.

## `audit` — audit trail

```bash
sabia audit verify [file]      # check the hash-chain integrity
sabia audit show [--limit 20]  # latest entries
```

## `update` — updating

```bash
sabia update           # check for a new version
sabia update --apply   # download, verify the SHA-256 and swap the executable
```

## `ui` — desktop/web interface

```bash
sabia ui [--port 4337] [--no-open]
```

Starts the local interface server and opens the browser (or not, with `--no-open`).