Lucas RayanandClaude Sonnet 5.5
d885d92643
The updater reads the latest release from Gitea. update::apply refuses to overwrite anything but the CLI. Release workflow builds the Linux CLI; scripts/build-gui.sh builds the Linux and Windows desktop app. Docs say Linux and Windows only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
120 lines
6.8 KiB
Markdown
120 lines
6.8 KiB
Markdown
# Changelog
|
|
|
|
**English** · [Português](CHANGELOG.pt-BR.md)
|
|
|
|
Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer.
|
|
|
|
## [1.0.1] - 2026-10-30
|
|
|
|
The project moved from GitHub to Gitea, and the update check followed it.
|
|
|
|
### Changed
|
|
- **Updates now come from Gitea.** `sabia update` and the desktop app's "Update now"
|
|
read the latest release from `git.lucasrguerra.dev.br` instead of the GitHub API.
|
|
Versions up to 1.0.0 still look at GitHub, which is no longer reachable, so they
|
|
cannot find this release: download 1.0.1 once, and later updates are automatic.
|
|
- Release packages: the CLI for Linux x86_64 and aarch64 (built by the Gitea CI when
|
|
a `v*` tag is pushed, with a `.sha256` next to each package), and the desktop app
|
|
for Linux (`.AppImage`, `.deb`) and Windows (NSIS `.exe` installer, cross-compiled
|
|
from Linux by `scripts/build-gui.sh`). **There is no Windows CLI and no macOS build
|
|
any more**: the CLI is Linux-only, and macOS needs Apple's SDK and code signing,
|
|
which this project's CI cannot provide.
|
|
|
|
### Fixed
|
|
- `sabia update` refuses to run from the desktop app's executable (`sabia-gui`).
|
|
The release package contains the CLI, and replacing the app with it would have
|
|
broken the app; the app now points to the downloads page instead.
|
|
|
|
## [1.0.0] - 2026-10-24
|
|
|
|
First stable release: real-hardware validation across the whole attack surface, a much more complete cracking pipeline, two new attacks (WPS, Evil Twin), a redesigned report, and several reliability fixes found only by testing against live Wi-Fi networks.
|
|
|
|
### Added
|
|
- **Cracking:** default dictionary replaced by a 9.7M-password list (rockyou +
|
|
Probable-Wordlists, deduplicated, gzip-embedded); hashcat-style **mutation
|
|
rules** (uppercase, numeric/symbol suffixes, simple leet); **mask brute
|
|
force** (`?d?l?u?s?a` syntax); **`.hc22000` export** (single or batch) to
|
|
hand a handshake to hashcat/John.
|
|
- **WPS attack:** PIN/Pixie Dust via a bundled `reaver` (extracted at
|
|
runtime), or `bully` when installed on the system.
|
|
- **Evil Twin:** clones an already-seen AP (open SSID) on a second interface
|
|
with a captive portal, for WPA/WPA2-PSK — the submitted password is only
|
|
accepted after being verified against the real captured handshake, never
|
|
"accepts anything". An **Enterprise (802.1X/EAP)** variant captures
|
|
credentials automatically via `hostapd-wpe`, no portal or human action
|
|
needed, since the credential travels in the EAP handshake itself.
|
|
- **CCMP traffic decryption** for a client once its handshake's password is
|
|
known (Temporal Key derived from the cracked PMK).
|
|
- **Channel-interference scoring** per band and **security findings** (open
|
|
network, missing PMF, WPS exposed, possible evil twin by duplicate SSID).
|
|
- **Redesigned audit report:** full-page cover with embedded logo, table of
|
|
contents, running header/footer via `@page` margin boxes (current
|
|
section, page numbers), KPI and findings cards with severity colors —
|
|
still paginated by Paged.js in the browser, printable to PDF.
|
|
- `ScanSnapshot.warning`: tells you when a capture has been running for a
|
|
while without receiving a single frame — a card that accepts turning
|
|
monitor mode on without actually delivering capture (common with
|
|
built-in laptop Wi-Fi) now says so, instead of silently "listening".
|
|
|
|
### Fixed
|
|
- **Handshake capture never completed on real networks:** `eapol.rs` read
|
|
`key_info`/`replay_counter`/`key_data_len` as little-endian; those
|
|
802.1X fields are big-endian. Deauth worked, EAPOL frames were seen, but
|
|
`HandshakeTracker` silently discarded every one — 0 handshakes no matter
|
|
how much traffic was generated. The project's own synthetic test frames
|
|
made the same mistake symmetrically, so round-trip tests never caught
|
|
it; verified live against a real AP after the fix.
|
|
- **Monitor mode fighting NetworkManager:** `set_monitor()` now releases
|
|
the interface from NetworkManager before switching modes and returns it
|
|
afterward — without this, NM reasserted its own connection within
|
|
seconds and capture died with "is in managed mode".
|
|
- **Evil Twin left the system half-configured if the process died mid-run**
|
|
(Ctrl+C, `kill -9`, power loss): both interfaces stuck `managed=no`
|
|
forever, Wi-Fi gone from the system panel. A state file plus a
|
|
self-healing pass on every engine start now undoes this automatically;
|
|
`sabia ui` also handles SIGINT gracefully.
|
|
- **Repeated deauth/disassoc frames were dropped as duplicates** after the
|
|
first send — the same Sequence Control was reused on every injection;
|
|
now increments per frame.
|
|
- **Network list reordered under the cursor** during capture, as signal-based
|
|
sorting reacted to every 1-2 dBm fluctuation; order is now stable
|
|
(arrival order, signal rounded to 4 dBm buckets).
|
|
- **"Force handshake" failed if capture had been stopped:** it now resumes
|
|
capture automatically and waits for the target to reappear with a known
|
|
channel before starting the job, instead of locking onto whatever
|
|
channel the scanner happened to be hopping through.
|
|
- **Attacks tab layout left large empty gaps** when two cards of very
|
|
different heights shared a grid row; switched to a masonry-style column
|
|
layout.
|
|
|
|
### Changed
|
|
- `crack_reader`/`crack_mask` parallelize across available cores and reuse
|
|
the HMAC base per iteration instead of reconstructing it — roughly 640x
|
|
faster in release builds versus the original debug/single-thread path.
|
|
|
|
## [0.1.0] - 2026-10-23
|
|
|
|
First release: CLI, desktop app and shared core.
|
|
|
|
### Added
|
|
- `sabia-core`: Wi-Fi interface discovery, **monitor mode** and channel control
|
|
(via netlink/`iw`), **scanning** of 2.4, 5 and 6 GHz, raw 802.11 frame capture
|
|
via **AF_PACKET** (no libpcap), **radiotap** and management-frame parsing
|
|
(beacon, probe, EAPOL), aggregation of APs and clients, capture of the
|
|
**4-way handshake** and **PMKID**, **offline dictionary cracking**
|
|
(PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK, `.pcap` read and write,
|
|
frame injection, a local hash-chained **audit trail**, and **self-update**
|
|
from GitHub releases.
|
|
- `sabia`: CLI with `iface` (list/channels/monitor), `scan`, `analyze`, `crack`,
|
|
`deauth` (with `--yes`), `doctor`, `audit` (verify/show), `update` and `ui`
|
|
(local interface server).
|
|
- Desktop app (Tauri) with the same interface served by `sabia ui`, elevating to
|
|
administrator automatically on startup — monitor mode and raw capture require
|
|
root/admin.
|
|
- Interface: interface sidebar, capture panel with an animated signal line,
|
|
networks table with signal bars and color-coded security badges, an
|
|
**authorized-use** notice, a one-click **update** button, Auto/Light/Dark
|
|
themes and **Portuguese and English** language.
|
|
- CI with caches (`rust-cache`, cached Tauri `.deb`) and a cross-platform release
|
|
pipeline (CLI on 5 targets and desktop app via `tauri-action`).
|