sabia/CHANGELOG.md

Changelog

English · Português

Format based on Keep a Changelog; versions follow SemVer.

[1.0.2] - 2026-10-30

Fixed

• The desktop app build on CI looked for its bundle under target/, but the runner's Cargo target directory is elsewhere and persists between runs; the Linux and Windows jobs failed before publishing anything. v1.0.1's desktop app was never published for this reason — use v1.0.2.

[1.0.1] - 2026-10-30

The project moved from GitHub to Gitea, and the update check followed it.

Changed

• Updates now come from Gitea. sabia update and the desktop app's "Update now" read the latest release from git.lucasrguerra.dev.br instead of the GitHub API. Versions up to 1.0.0 still look at GitHub, which is no longer reachable, so they cannot find this release: download 1.0.1 once, and later updates are automatic.
• Release packages: the CLI for Linux x86_64 and aarch64 (built by the Gitea CI when a v* tag is pushed, with a .sha256 next to each package), and the desktop app for Linux (.AppImage, .deb) and Windows (NSIS .exe installer, cross-compiled from Linux by scripts/build-gui.sh). There is no Windows CLI and no macOS build any more: the CLI is Linux-only, and macOS needs Apple's SDK and code signing, which this project's CI cannot provide.

Fixed

• sabia update refuses to run from the desktop app's executable (sabia-gui). The release package contains the CLI, and replacing the app with it would have broken the app; the app now points to the downloads page instead.

[1.0.0] - 2026-10-24

First stable release: real-hardware validation across the whole attack surface, a much more complete cracking pipeline, two new attacks (WPS, Evil Twin), a redesigned report, and several reliability fixes found only by testing against live Wi-Fi networks.

Added

• Cracking: default dictionary replaced by a 9.7M-password list (rockyou + Probable-Wordlists, deduplicated, gzip-embedded); hashcat-style mutation rules (uppercase, numeric/symbol suffixes, simple leet); mask brute force (?d?l?u?s?a syntax); .hc22000 export (single or batch) to hand a handshake to hashcat/John.
• WPS attack: PIN/Pixie Dust via a bundled reaver (extracted at runtime), or bully when installed on the system.
• Evil Twin: clones an already-seen AP (open SSID) on a second interface with a captive portal, for WPA/WPA2-PSK — the submitted password is only accepted after being verified against the real captured handshake, never "accepts anything". An Enterprise (802.1X/EAP) variant captures credentials automatically via hostapd-wpe, no portal or human action needed, since the credential travels in the EAP handshake itself.
• CCMP traffic decryption for a client once its handshake's password is known (Temporal Key derived from the cracked PMK).
• Channel-interference scoring per band and security findings (open network, missing PMF, WPS exposed, possible evil twin by duplicate SSID).
• Redesigned audit report: full-page cover with embedded logo, table of contents, running header/footer via @page margin boxes (current section, page numbers), KPI and findings cards with severity colors — still paginated by Paged.js in the browser, printable to PDF.
• ScanSnapshot.warning: tells you when a capture has been running for a while without receiving a single frame — a card that accepts turning monitor mode on without actually delivering capture (common with built-in laptop Wi-Fi) now says so, instead of silently "listening".

Fixed

• Handshake capture never completed on real networks: eapol.rs read key_info/replay_counter/key_data_len as little-endian; those 802.1X fields are big-endian. Deauth worked, EAPOL frames were seen, but HandshakeTracker silently discarded every one — 0 handshakes no matter how much traffic was generated. The project's own synthetic test frames made the same mistake symmetrically, so round-trip tests never caught it; verified live against a real AP after the fix.
• Monitor mode fighting NetworkManager: set_monitor() now releases the interface from NetworkManager before switching modes and returns it afterward — without this, NM reasserted its own connection within seconds and capture died with "is in managed mode".
• Evil Twin left the system half-configured if the process died mid-run (Ctrl+C, kill -9, power loss): both interfaces stuck managed=no forever, Wi-Fi gone from the system panel. A state file plus a self-healing pass on every engine start now undoes this automatically; sabia ui also handles SIGINT gracefully.
• Repeated deauth/disassoc frames were dropped as duplicates after the first send — the same Sequence Control was reused on every injection; now increments per frame.
• Network list reordered under the cursor during capture, as signal-based sorting reacted to every 1-2 dBm fluctuation; order is now stable (arrival order, signal rounded to 4 dBm buckets).
• "Force handshake" failed if capture had been stopped: it now resumes capture automatically and waits for the target to reappear with a known channel before starting the job, instead of locking onto whatever channel the scanner happened to be hopping through.
• Attacks tab layout left large empty gaps when two cards of very different heights shared a grid row; switched to a masonry-style column layout.

Changed

• crack_reader/crack_mask parallelize across available cores and reuse the HMAC base per iteration instead of reconstructing it — roughly 640x faster in release builds versus the original debug/single-thread path.

[0.1.0] - 2026-10-23

First release: CLI, desktop app and shared core.

Added

• sabia-core: Wi-Fi interface discovery, monitor mode and channel control (via netlink/iw), scanning of 2.4, 5 and 6 GHz, raw 802.11 frame capture via AF_PACKET (no libpcap), radiotap and management-frame parsing (beacon, probe, EAPOL), aggregation of APs and clients, capture of the 4-way handshake and PMKID, offline dictionary cracking (PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK, .pcap read and write, frame injection, a local hash-chained audit trail, and self-update from GitHub releases.
• sabia: CLI with iface (list/channels/monitor), scan, analyze, crack, deauth (with --yes), doctor, audit (verify/show), update and ui (local interface server).
• Desktop app (Tauri) with the same interface served by sabia ui, elevating to administrator automatically on startup — monitor mode and raw capture require root/admin.
• Interface: interface sidebar, capture panel with an animated signal line, networks table with signal bars and color-coded security badges, an authorized-use notice, a one-click update button, Auto/Light/Dark themes and Portuguese and English language.
• CI with caches (rust-cache, cached Tauri .deb) and a cross-platform release pipeline (CLI on 5 targets and desktop app via tauri-action).