7 Releases 7 Tags

RSS Feed

• v1.0.0 f62e7fd0a1

  Compare

  Sabiá 1.0.0 Stable

  lucasrguerra released this 2026-10-30 15:38:25 +00:00 | 18 commits to main since this release

  First stable release: real-hardware validation across the whole attack surface, a much more complete cracking pipeline, two new attacks (WPS, Evil Twin), a redesigned report, and several reliability fixes found only by testing against live Wi-Fi networks.

  Added

  • Cracking: default dictionary replaced by a 9.7M-password list (rockyou +
    Probable-Wordlists, deduplicated, gzip-embedded); hashcat-style mutation
    rules (uppercase, numeric/symbol suffixes, simple leet); mask brute
    force (?d?l?u?s?a syntax); .hc22000 export (single or batch) to
    hand a handshake to hashcat/John.
  • WPS attack: PIN/Pixie Dust via a bundled reaver (extracted at
    runtime), or bully when installed on the system.
  • Evil Twin: clones an already-seen AP (open SSID) on a second interface
    with a captive portal, for WPA/WPA2-PSK — the submitted password is only
    accepted after being verified against the real captured handshake, never
    "accepts anything". An Enterprise (802.1X/EAP) variant captures
    credentials automatically via hostapd-wpe, no portal or human action
    needed, since the credential travels in the EAP handshake itself.
  • CCMP traffic decryption for a client once its handshake's password is
    known (Temporal Key derived from the cracked PMK).
  • Channel-interference scoring per band and security findings (open
    network, missing PMF, WPS exposed, possible evil twin by duplicate SSID).
  • Redesigned audit report: full-page cover with embedded logo, table of
    contents, running header/footer via @page margin boxes (current
    section, page numbers), KPI and findings cards with severity colors —
    still paginated by Paged.js in the browser, printable to PDF.
  • ScanSnapshot.warning: tells you when a capture has been running for a
    while without receiving a single frame — a card that accepts turning
    monitor mode on without actually delivering capture (common with
    built-in laptop Wi-Fi) now says so, instead of silently "listening".

  Fixed

  • Handshake capture never completed on real networks: eapol.rs read
    key_info/replay_counter/key_data_len as little-endian; those
    802.1X fields are big-endian. Deauth worked, EAPOL frames were seen, but
    HandshakeTracker silently discarded every one — 0 handshakes no matter
    how much traffic was generated. The project's own synthetic test frames
    made the same mistake symmetrically, so round-trip tests never caught
    it; verified live against a real AP after the fix.
  • Monitor mode fighting NetworkManager: set_monitor() now releases
    the interface from NetworkManager before switching modes and returns it
    afterward — without this, NM reasserted its own connection within
    seconds and capture died with "is in managed mode".
  • Evil Twin left the system half-configured if the process died mid-run
    (Ctrl+C, kill -9, power loss): both interfaces stuck managed=no
    forever, Wi-Fi gone from the system panel. A state file plus a
    self-healing pass on every engine start now undoes this automatically;
    sabia ui also handles SIGINT gracefully.
  • Repeated deauth/disassoc frames were dropped as duplicates after the
    first send — the same Sequence Control was reused on every injection;
    now increments per frame.
  • Network list reordered under the cursor during capture, as signal-based
    sorting reacted to every 1-2 dBm fluctuation; order is now stable
    (arrival order, signal rounded to 4 dBm buckets).
  • "Force handshake" failed if capture had been stopped: it now resumes
    capture automatically and waits for the target to reappear with a known
    channel before starting the job, instead of locking onto whatever
    channel the scanner happened to be hopping through.
  • Attacks tab layout left large empty gaps when two cards of very
    different heights shared a grid row; switched to a masonry-style column
    layout.

  Changed

  • crack_reader/crack_mask parallelize across available cores and reuse
    the HMAC base per iteration instead of reconstructing it — roughly 640x
    faster in release builds versus the original debug/single-thread path.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)