sabia/docs/support.md

What Sabiá supports

English · Português

Matrix of what exists today (version 1.0.3). For what comes next, see the ROADMAP.

Platforms

	Discovery and capture	Offline analysis and cracking	Desktop app
Linux	✅ root, adapter in monitor mode	✅	✅ AppImage and deb
Windows	❌	✅ .pcap, wordlist/rules/mask	✅ installer
macOS	❌	✅ .pcap, wordlist/rules/mask	❌ no build

Live capture uses AF_PACKET and netlink; it needs Linux, root (or CAP_NET_ADMIN/CAP_NET_RAW) and an adapter that supports monitor mode. Injection (deauth, Evil Twin) needs an adapter that also supports injection. The desktop app asks for elevation on startup.

Discovery

• 2.4, 5 and 6 GHz channel sweep, limited by the adapter and the regulatory domain.
• Access points and clients with SSID, BSSID, channel, signal, security type, WPS details and vendor.
• Monitor mode on/off through netlink/iw, with automatic recovery if NetworkManager takes the interface back.
• Supported channels reported per radio.

Capture and analysis

Item	Support
4-way handshake (EAPOL)	✅ detected and stored for offline cracking
PMKID	✅ detected and stored, including clientless PMKID hunting
.pcap write and read	✅ compatible with other 802.11 tools
CCMP decryption	✅ for a client whose PSK is already known
Radiotap / 802.11 / EAPOL parsing	✅

Cracking (WPA/WPA2-PSK)

Mode	Support
Dictionary	✅ rockyou + Probable-Wordlists by default (9.7 million passwords)
Mutation rules	✅ hashcat-style rules
Mask/brute force	✅ ?d?l?u?s?a
Verification	✅ PBKDF2-HMAC-SHA1 PMK + MIC (4-way) or PMKID
Export	✅ .hc22000 for hashcat/John

WPA3/SAE does not fall to a handshake dictionary attack; the cracking scope is WPA/WPA2-PSK.

Authorized attacks

• Deauthentication directed or continuous, with --yes / explicit authorization checkbox.
• PMF test and clientless PMKID hunt.
• WPS PIN / Pixie Dust using the bundled reaver (GPL-2) or bully when installed.
• Evil Twin PSK: clones a seen AP with a captive portal; the password is only accepted after being checked against the real captured handshake.
• Evil Twin Enterprise (802.1X/EAP): captures credentials automatically, without a portal. It needs hostapd-wpe and a second Wi-Fi interface in AP mode.

Reports, audit and diagnostics

• Paginated audit report (cover, table of contents, findings, channel score, audit trail), generated locally.
• Hash-chained audit trail for every monitor-mode activation and capture session (sabia audit show).
• sabia doctor checks privileges, tools and interfaces before capture.

What Sabiá does not do

• Crack WPA3/SAE handshakes, or recover a password without a captured handshake/PMKID and a matching candidate.
• Capture on Windows or macOS; those platforms are offline analysis only.
• Bypass the authorization requirement for deauth, WPS or Evil Twin.
• Guarantee 5/6 GHz coverage: it depends on the adapter, regulatory domain and driver.
• Make an enterprise client trust a self-signed certificate when the client validates the chain (common in managed corporate profiles).
• Provide GPU acceleration yet; cracking is CPU-bound.