Lucas Rayan
91aacba939
- eviltwin.rs: clona um AP já visto na sessão (SSID aberto) numa segunda interface, com portal cativo pedindo a senha de novo. A senha só é aceita se bater de verdade contra o handshake real já capturado (CrackTarget::verify) — não é um "aceita qualquer coisa", é um oráculo criptográfico. Exige handshake quebrável já capturado desse BSSID e autorização explícita, mesma trilha de auditoria dos outros ataques. - eviltwin_enterprise.rs: variante pra redes WPA2/WPA3-Enterprise (802.1X) — nelas a credencial viaja no próprio handshake EAP (PEAP/TTLS-MSCHAPv2), então o cliente autentica sozinho em qualquer AP que anuncie o SSID, sem portal nem ação humana. Orquestra hostapd-wpe (não vendorizado — é um patch no build do hostapd); gera certificado TLS autoassinado e eap_user genérico; parser best-effort do log de credenciais capturadas. Limitação documentada: cliente que valida a cadeia de certificado recusa a conexão. - analysis.rs: achados de segurança (rede aberta, sem PMF, WPS ativo, possível evil twin real por nome duplicado) e recomendação de canal por banda com pontuação de interferência/sobreposição.
Sabiá
Free and open Wi-Fi auditing.
Terminal and desktop app · live capture on Linux, offline analysis on Windows, Linux and macOS · authorized use.
Terminal · Interface · Architecture · Roadmap · Changelog
English · Português
Sabiá brings together, in a single sweep, what tools like airodump-ng, hcxdumptool, aircrack-ng and wifite do separately — in one Rust binary, with no libpcap dependency:
- Network discovery: hops across the 2.4, 5 and 6 GHz channels and lists access points and associated clients, with SSID, BSSID, channel, signal and security type.
- Monitor mode without scripts: turns the card's monitor mode on and off straight through netlink/
iw, and shows which channels the radio supports. - Handshake capture: recognizes the 4-way handshake (EAPOL) and the PMKID on the air and keeps only what offline cracking needs.
- Offline dictionary cracking: recomputes the PMK with PBKDF2-HMAC-SHA1 and checks the MIC (4-way) or the PMKID (
HMAC-SHA1(PMK, "PMK Name" …)) — for WPA/WPA2-PSK. - pcap round-trip: writes captured frames to
.pcapand analyzes a.pcapoffline (networks, clients and handshakes), interoperable with the other tools. - Deauthentication test: sends deauth to an AP/station to force a reassociation — only with an explicit authorization confirmation (
--yes). - Audit trail: every monitor-mode activation and capture session is recorded in a local hash-chained trail.
- Diagnostics:
doctorchecks privileges, tools and interfaces before you start.
Authorized use
Sabiá is an auditing tool — for testing the security of networks you own or have explicit authorization to assess.
- Capturing handshakes, sending deauthentication or cracking passwords on third-party networks without permission is illegal in most countries. The responsibility is the operator's.
- Deauthentication (
deauth) requires the--yesflag, an assertion that you are authorized to test that network. - Every monitor-mode activation and capture session is recorded in the local audit trail (
sabia audit show), hash-chained to detect tampering. - Nothing of yours leaves the machine. The only network access by default is the update check on startup (which can be disabled).
- Dictionary passwords and handshakes stay on your machine.
Install
Download the package for your system from Releases:
| CLI | Desktop app | |
|---|---|---|
| Windows | sabia-*-windows-x86_64.zip |
.msi / .exe installer |
| macOS | sabia-*-macos-{aarch64,x86_64}.tar.gz |
.dmg |
| Linux | sabia-*-linux-{x86_64,aarch64}.tar.gz |
.AppImage / .deb |
Each file has a .sha256 next to it. Build from source: cargo build --release -p sabia-cli (Rust 1.80+).
Updates: the desktop app checks GitHub on startup; when a new version exists, a button offers Update now: it downloads the right binary for your platform, verifies the SHA-256 and swaps the running executable — no manual download. The check is a single request to the releases API and sends nothing of yours.
The binaries are not signed yet: Windows SmartScreen and macOS Gatekeeper will warn. Check the SHA-256.
Capture and monitor mode require Linux and root (CAP_NET_ADMIN/CAP_NET_RAW): raw capture uses AF_PACKET and interface control uses netlink. Offline .pcap analysis and cracking also run on Windows and macOS. The desktop app elevates to administrator on its own at startup.
Getting started
sabia doctor # privileges, tools and interfaces
sabia iface list # Wi-Fi interfaces and their modes
sudo sabia iface monitor wlan0 on # enable monitor mode
sudo sabia scan wlan0 --band all --out air.pcap # hop channels and record the air
sabia analyze air.pcap # read a .pcap offline
sabia crack air.pcap --wordlist list.txt # crack the handshake by dictionary
Authorized deauthentication testing and all other commands (audit, update, ui) are in docs/cli.md.
Desktop app
Desktop app (Tauri) with an interface sidebar, a capture panel with an animated signal line, and a networks table with signal bars and color-coded security badges. The same front-end runs in the browser with sabia ui. More in docs/interface.md.
- Pick the interface, toggle monitor mode and start/stop capture by button.
- Live networks seen table, with signal, channel and security.
- An authorized-use notice always in view and automatic privilege elevation on startup.
- One-click update button, Auto, Light and Dark themes and interface in Portuguese and English.
Known limits
- Capture is Linux-only, with a card that supports monitor mode (and injection, for
deauth). On Windows and macOS Sabiá only does.pcapanalysis and offline cracking. - WPA3/SAE does not fall to handshake dictionaries — cracking covers WPA/WPA2-PSK (4-way and PMKID).
- 5 and 6 GHz depend on the card and the regulatory domain; some channels stay passive (no probing).
- Passwords outside the dictionary don't come back: cracking is dictionary force only, no rules or masks yet.
- Windows and macOS: the code compiles and is tested in CI, but live capture does not run on those platforms.
Where it's going
Summary of the ROADMAP:
| Done | Monitor mode via netlink, 2.4/5/6 GHz scanning, 4-way and PMKID capture, .pcap read/write, dictionary cracking (WPA/WPA2-PSK), authorized deauth, hash-chained audit trail, doctor, CLI + desktop app, one-click update |
| Next | Rules and masks in cracking, GPU acceleration, export to the hashcat format (22000) |
| Later | WPS attack, rogue AP / evil twin for authorized testing, capture on Windows (Npcap) |
| Long term | WPA3/SAE downgrade, validation on varied hardware |
Development
crates/sabia-core core: interfaces, netlink, radiotap, 802.11, EAPOL, handshake, capture, crack, audit, update
crates/sabia-cli the `sabia` binary (CLI + local UI server)
apps/gui interface (ui/ = HTML, CSS and JS; src-tauri/ = desktop app)
scripts/ CI helpers (cached dependency install, i18n coverage check)
docs/ terminal, interface and architecture
cargo test --workspace
cargo clippy --workspace --all-targets
node scripts/check-ui-i18n.mjs # UI translation coverage
See CONTRIBUTING.md and docs/architecture.md. Versions follow SemVer; changes in CHANGELOG.md. To release: git tag vX.Y.Z && git push --tags (the release workflow builds and publishes everything). Vulnerabilities: SECURITY.md.
License
MIT or Apache-2.0, your choice.