sabia/CHANGELOG.md

Changelog

English · Português

Format based on Keep a Changelog; versions follow SemVer.

[1.0.0] - 2026-10-24

First stable release: real-hardware validation across the whole attack surface, a much more complete cracking pipeline, two new attacks (WPS, Evil Twin), a redesigned report, and several reliability fixes found only by testing against live Wi-Fi networks.

Added

• Cracking: default dictionary replaced by a 9.7M-password list (rockyou + Probable-Wordlists, deduplicated, gzip-embedded); hashcat-style mutation rules (uppercase, numeric/symbol suffixes, simple leet); mask brute force (?d?l?u?s?a syntax); .hc22000 export (single or batch) to hand a handshake to hashcat/John.
• WPS attack: PIN/Pixie Dust via a bundled reaver (extracted at runtime), or bully when installed on the system.
• Evil Twin: clones an already-seen AP (open SSID) on a second interface with a captive portal, for WPA/WPA2-PSK — the submitted password is only accepted after being verified against the real captured handshake, never "accepts anything". An Enterprise (802.1X/EAP) variant captures credentials automatically via hostapd-wpe, no portal or human action needed, since the credential travels in the EAP handshake itself.
• CCMP traffic decryption for a client once its handshake's password is known (Temporal Key derived from the cracked PMK).
• Channel-interference scoring per band and security findings (open network, missing PMF, WPS exposed, possible evil twin by duplicate SSID).
• Redesigned audit report: full-page cover with embedded logo, table of contents, running header/footer via @page margin boxes (current section, page numbers), KPI and findings cards with severity colors — still paginated by Paged.js in the browser, printable to PDF.
• ScanSnapshot.warning: tells you when a capture has been running for a while without receiving a single frame — a card that accepts turning monitor mode on without actually delivering capture (common with built-in laptop Wi-Fi) now says so, instead of silently "listening".

Fixed

• Handshake capture never completed on real networks: eapol.rs read key_info/replay_counter/key_data_len as little-endian; those 802.1X fields are big-endian. Deauth worked, EAPOL frames were seen, but HandshakeTracker silently discarded every one — 0 handshakes no matter how much traffic was generated. The project's own synthetic test frames made the same mistake symmetrically, so round-trip tests never caught it; verified live against a real AP after the fix.
• Monitor mode fighting NetworkManager: set_monitor() now releases the interface from NetworkManager before switching modes and returns it afterward — without this, NM reasserted its own connection within seconds and capture died with "is in managed mode".
• Evil Twin left the system half-configured if the process died mid-run (Ctrl+C, kill -9, power loss): both interfaces stuck managed=no forever, Wi-Fi gone from the system panel. A state file plus a self-healing pass on every engine start now undoes this automatically; sabia ui also handles SIGINT gracefully.
• Repeated deauth/disassoc frames were dropped as duplicates after the first send — the same Sequence Control was reused on every injection; now increments per frame.
• Network list reordered under the cursor during capture, as signal-based sorting reacted to every 1-2 dBm fluctuation; order is now stable (arrival order, signal rounded to 4 dBm buckets).
• "Force handshake" failed if capture had been stopped: it now resumes capture automatically and waits for the target to reappear with a known channel before starting the job, instead of locking onto whatever channel the scanner happened to be hopping through.
• Attacks tab layout left large empty gaps when two cards of very different heights shared a grid row; switched to a masonry-style column layout.

Changed

• crack_reader/crack_mask parallelize across available cores and reuse the HMAC base per iteration instead of reconstructing it — roughly 640x faster in release builds versus the original debug/single-thread path.

[0.1.0] - 2026-10-23

First release: CLI, desktop app and shared core.

Added

• sabia-core: Wi-Fi interface discovery, monitor mode and channel control (via netlink/iw), scanning of 2.4, 5 and 6 GHz, raw 802.11 frame capture via AF_PACKET (no libpcap), radiotap and management-frame parsing (beacon, probe, EAPOL), aggregation of APs and clients, capture of the 4-way handshake and PMKID, offline dictionary cracking (PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK, .pcap read and write, frame injection, a local hash-chained audit trail, and self-update from GitHub releases.
• sabia: CLI with iface (list/channels/monitor), scan, analyze, crack, deauth (with --yes), doctor, audit (verify/show), update and ui (local interface server).
• Desktop app (Tauri) with the same interface served by sabia ui, elevating to administrator automatically on startup — monitor mode and raw capture require root/admin.
• Interface: interface sidebar, capture panel with an animated signal line, networks table with signal bars and color-coded security badges, an authorized-use notice, a one-click update button, Auto/Light/Dark themes and Portuguese and English language.
• CI with caches (rust-cache, cached Tauri .deb) and a cross-platform release pipeline (CLI on 5 targets and desktop app via tauri-action).