Free and open Wi-Fi auditing.
Terminal and desktop app · live capture on Linux, offline analysis on Windows, Linux and macOS · authorized use.
Terminal · Interface · Architecture · Roadmap · Changelog
English · Português
--- Sabiá brings together, in a single sweep, what tools like `airodump-ng`, `hcxdumptool`, `aircrack-ng` and `wifite` do separately — in one Rust binary, with no `libpcap` dependency: - **Network discovery:** hops across the **2.4, 5 and 6 GHz** channels and lists access points and associated clients, with SSID, BSSID, channel, signal and security type. - **Monitor mode without scripts:** turns the card's monitor mode on and off straight through netlink/`iw`, and shows which channels the radio supports. - **Handshake capture:** recognizes the **4-way handshake (EAPOL)** and the **PMKID** on the air and keeps only what offline cracking needs. - **Offline dictionary cracking:** recomputes the PMK with **PBKDF2-HMAC-SHA1** and checks the **MIC** (4-way) or the **PMKID** (`HMAC-SHA1(PMK, "PMK Name" …)`) — for WPA/WPA2-PSK. - **pcap round-trip:** writes captured frames to `.pcap` and **analyzes a `.pcap` offline** (networks, clients and handshakes), interoperable with the other tools. - **Deauthentication test:** sends _deauth_ to an AP/station to force a reassociation — only with an explicit authorization confirmation (`--yes`). - **Audit trail:** every monitor-mode activation and capture session is recorded in a local **hash-chained** trail. - **Diagnostics:** `doctor` checks privileges, tools and interfaces before you start. ## Authorized use Sabiá is an **auditing** tool — for testing the security of networks you **own** or have **explicit authorization** to assess. - Capturing handshakes, sending deauthentication or cracking passwords on third-party networks **without permission is illegal** in most countries. The responsibility is the operator's. - Deauthentication (`deauth`) requires the `--yes` flag, an assertion that you are authorized to test that network. - Every monitor-mode activation and capture session is **recorded in the local audit trail** (`sabia audit show`), hash-chained to detect tampering. - **Nothing of yours leaves the machine.** The only network access by default is the update check on startup (which can be disabled). - Dictionary passwords and handshakes stay on your machine. ## Install Download the package for your system from **[Releases](../../releases)**: | | CLI | Desktop app | |---|---|---| | Windows | `sabia-*-windows-x86_64.zip` | `.msi` / `.exe` installer | | macOS | `sabia-*-macos-{aarch64,x86_64}.tar.gz` | `.dmg` | | Linux | `sabia-*-linux-{x86_64,aarch64}.tar.gz` | `.AppImage` / `.deb` | Each file has a `.sha256` next to it. Build from source: `cargo build --release -p sabia-cli` (Rust 1.80+). **Updates:** the desktop app checks GitHub on startup; when a new version exists, a button offers **Update now**: it downloads the right binary for your platform, verifies the **SHA-256** and swaps the running executable — no manual download. The check is a single request to the releases API and sends nothing of yours. > The binaries are **not signed yet**: Windows SmartScreen and macOS Gatekeeper will warn. Check the SHA-256. **Capture and monitor mode require Linux and root** (`CAP_NET_ADMIN`/`CAP_NET_RAW`): raw capture uses `AF_PACKET` and interface control uses netlink. **Offline `.pcap` analysis and cracking** also run on Windows and macOS. The desktop app elevates to administrator on its own at startup. ## Getting started ```bash sabia doctor # privileges, tools and interfaces sabia iface list # Wi-Fi interfaces and their modes sudo sabia iface monitor wlan0 on # enable monitor mode sudo sabia scan wlan0 --band all --out air.pcap # hop channels and record the air sabia analyze air.pcap # read a .pcap offline sabia crack air.pcap --wordlist list.txt # crack the handshake by dictionary ``` Authorized deauthentication testing and all other commands (`audit`, `update`, `ui`) are in **[docs/cli.md](docs/cli.md)**. ## Desktop app Desktop app (Tauri) with an interface sidebar, a capture panel with an animated signal line, and a networks table with signal bars and color-coded security badges. The same front-end runs in the browser with `sabia ui`. More in **[docs/interface.md](docs/interface.md)**. - Pick the interface, toggle **monitor mode** and start/stop **capture** by button. - Live **networks seen** table, with signal, channel and security. - An **authorized-use** notice always in view and automatic privilege elevation on startup. - One-click **update** button, **Auto, Light and Dark** themes and interface in **Portuguese and English**. ## Known limits - **Capture is Linux-only**, with a card that supports **monitor mode** (and injection, for `deauth`). On Windows and macOS Sabiá only does `.pcap` analysis and offline cracking. - **WPA3/SAE** does not fall to handshake dictionaries — cracking covers **WPA/WPA2-PSK** (4-way and PMKID). - **5 and 6 GHz** depend on the card and the regulatory domain; some channels stay passive (no probing). - **Passwords outside the dictionary don't come back:** cracking is dictionary force only, no rules or masks yet. - **Windows and macOS:** the code compiles and is tested in CI, but live capture does not run on those platforms. ## Where it's going Summary of the [ROADMAP](ROADMAP.md): | | | |---|---| | **Done** | Monitor mode via netlink, 2.4/5/6 GHz scanning, 4-way and PMKID capture, `.pcap` read/write, dictionary cracking (WPA/WPA2-PSK), authorized `deauth`, hash-chained audit trail, `doctor`, CLI + desktop app, one-click update | | **Next** | Rules and masks in cracking, GPU acceleration, export to the hashcat format (`22000`) | | **Later** | WPS attack, rogue AP / evil twin for authorized testing, capture on Windows (Npcap) | | **Long term** | WPA3/SAE downgrade, validation on varied hardware | ## Development ``` crates/sabia-core core: interfaces, netlink, radiotap, 802.11, EAPOL, handshake, capture, crack, audit, update crates/sabia-cli the `sabia` binary (CLI + local UI server) apps/gui interface (ui/ = HTML, CSS and JS; src-tauri/ = desktop app) scripts/ CI helpers (cached dependency install, i18n coverage check) docs/ terminal, interface and architecture ``` ```bash cargo test --workspace cargo clippy --workspace --all-targets node scripts/check-ui-i18n.mjs # UI translation coverage ``` See [CONTRIBUTING.md](CONTRIBUTING.md) and [docs/architecture.md](docs/architecture.md). Versions follow [SemVer](https://semver.org/); changes in [CHANGELOG.md](CHANGELOG.md). To release: `git tag vX.Y.Z && git push --tags` (the `release` workflow builds and publishes everything). Vulnerabilities: [SECURITY.md](SECURITY.md). ## License [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), your choice.