Lucas Rayan
659701b2d4
CI / Formatação e clippy (push) Successful in 1m9s
CI / Auditoria de dependências (push) Successful in 12s
CI / Testes (Linux) (push) Successful in 1m34s
Release / Cria a release (push) Successful in 5s
CI / Compila o app desktop (Linux) (push) Successful in 1m36s
Release / CLI (linux-aarch64) (push) Successful in 1m23s
Release / CLI (linux-x86_64) (push) Successful in 1m40s
Release / App desktop (linux-aarch64) (push) Successful in 7m32s
Release / App desktop (linux-x86_64) (push) Failing after 9m5s
Release / App desktop (windows) (push) Failing after 6m20s
68 lines
3.3 KiB
Markdown
68 lines
3.3 KiB
Markdown
# What Sabiá supports
|
|
|
|
[English](support.md) · [Português](pt-BR/suporte.md)
|
|
|
|
Matrix of what exists today (version 1.0.3). For what comes next, see the [ROADMAP](../ROADMAP.md).
|
|
|
|
## Platforms
|
|
|
|
| | Discovery and capture | Offline analysis and cracking | Desktop app |
|
|
|---|---|---|---|
|
|
| Linux | ✅ root, adapter in monitor mode | ✅ | ✅ AppImage and deb |
|
|
| Windows | ❌ | ✅ `.pcap`, wordlist/rules/mask | ✅ installer |
|
|
| macOS | ❌ | ✅ `.pcap`, wordlist/rules/mask | ❌ no build |
|
|
|
|
Live capture uses `AF_PACKET` and netlink; it needs Linux, root (or `CAP_NET_ADMIN`/`CAP_NET_RAW`) and an adapter that supports monitor mode. Injection (`deauth`, Evil Twin) needs an adapter that also supports injection. The desktop app asks for elevation on startup.
|
|
|
|
## Discovery
|
|
|
|
- **2.4, 5 and 6 GHz** channel sweep, limited by the adapter and the regulatory domain.
|
|
- **Access points and clients** with SSID, BSSID, channel, signal, security type, WPS details and vendor.
|
|
- **Monitor mode** on/off through netlink/`iw`, with automatic recovery if NetworkManager takes the interface back.
|
|
- **Supported channels** reported per radio.
|
|
|
|
## Capture and analysis
|
|
|
|
| Item | Support |
|
|
|---|---|
|
|
| 4-way handshake (EAPOL) | ✅ detected and stored for offline cracking |
|
|
| PMKID | ✅ detected and stored, including clientless PMKID hunting |
|
|
| `.pcap` write and read | ✅ compatible with other 802.11 tools |
|
|
| CCMP decryption | ✅ for a client whose PSK is already known |
|
|
| Radiotap / 802.11 / EAPOL parsing | ✅ |
|
|
|
|
## Cracking (WPA/WPA2-PSK)
|
|
|
|
| Mode | Support |
|
|
|---|---|
|
|
| Dictionary | ✅ rockyou + Probable-Wordlists by default (9.7 million passwords) |
|
|
| Mutation rules | ✅ hashcat-style rules |
|
|
| Mask/brute force | ✅ `?d?l?u?s?a` |
|
|
| Verification | ✅ PBKDF2-HMAC-SHA1 PMK + MIC (4-way) or PMKID |
|
|
| Export | ✅ `.hc22000` for hashcat/John |
|
|
|
|
WPA3/SAE does **not** fall to a handshake dictionary attack; the cracking scope is WPA/WPA2-PSK.
|
|
|
|
## Authorized attacks
|
|
|
|
- **Deauthentication** directed or continuous, with `--yes` / explicit authorization checkbox.
|
|
- **PMF test** and **clientless PMKID hunt**.
|
|
- **WPS PIN / Pixie Dust** using the bundled `reaver` (GPL-2) or `bully` when installed.
|
|
- **Evil Twin PSK**: clones a seen AP with a captive portal; the password is only accepted after being checked against the real captured handshake.
|
|
- **Evil Twin Enterprise** (802.1X/EAP): captures credentials automatically, without a portal. It needs `hostapd-wpe` and a second Wi-Fi interface in AP mode.
|
|
|
|
## Reports, audit and diagnostics
|
|
|
|
- **Paginated audit report** (cover, table of contents, findings, channel score, audit trail), generated locally.
|
|
- **Hash-chained audit trail** for every monitor-mode activation and capture session (`sabia audit show`).
|
|
- **`sabia doctor`** checks privileges, tools and interfaces before capture.
|
|
|
|
## What Sabiá does not do
|
|
|
|
- Crack WPA3/SAE handshakes, or recover a password without a captured handshake/PMKID and a matching candidate.
|
|
- Capture on Windows or macOS; those platforms are offline analysis only.
|
|
- Bypass the authorization requirement for deauth, WPS or Evil Twin.
|
|
- Guarantee 5/6 GHz coverage: it depends on the adapter, regulatory domain and driver.
|
|
- Make an enterprise client trust a self-signed certificate when the client validates the chain (common in managed corporate profiles).
|
|
- Provide GPU acceleration yet; cracking is CPU-bound.
|