Files
sabia/docs/cli.md
T
Lucas Rayan f62e7fd0a1
Release / Cria a release (push) Canceled after 0s
Release / CLI (linux-aarch64) (push) Canceled after 0s
Release / CLI (linux-x86_64) (push) Canceled after 0s
Release / CLI (macos-aarch64) (push) Canceled after 0s
Release / CLI (macos-x86_64) (push) Canceled after 0s
Release / CLI (windows-x86_64) (push) Canceled after 0s
Release / App desktop (linux-x86_64) (push) Canceled after 0s
Release / App desktop (macos-aarch64) (push) Canceled after 0s
Release / App desktop (macos-x86_64) (push) Canceled after 0s
Release / App desktop (windows-x86_64) (push) Canceled after 0s
Release / Publica a release (push) Canceled after 0s
chore(release): v1.0.0
Primeira versão estável: valida ponta a ponta contra hardware real (Evil
Twin PSK e Enterprise, WPS, quebra com regras/máscara, relatório) e fecha
o roadmap de 0.1.0 quase inteiro. Changelog completo em CHANGELOG.md.

- Cargo.toml (workspace + app desktop) e tauri.conf.json: 0.1.0 → 1.0.0.
- README/ROADMAP (EN+PT-BR): refletem o que de fato existe agora
  (regras/máscara, .hc22000, WPS, Evil Twin, relatório), não mais "Next".
- docs/cli.md e docs/interface.md (EN+PT-BR): documentam --rules no
  crack e a aba Ataques/relatório da interface.
2026-10-24 15:00:57 -03:00

84 lines
2.8 KiB
Markdown

# Terminal (`sabia`)
**English** · [Português](pt-BR/cli.md)
The `sabia` binary has the global option `--audit <file>` (audit trail; default `.sabia-audit.log`) and the commands below. Capture and monitor mode require Linux and root; analysis and cracking run on any platform.
## `iface` — interfaces and monitor mode
```bash
sabia iface list # Wi-Fi interfaces and their modes
sabia iface channels <iface> # channels the radio supports [--json]
sudo sabia iface monitor <iface> on # enable monitor mode (on|off)
```
## `scan` — capture the air
```bash
sudo sabia scan <iface> [options]
```
| Option | Effect |
|---|---|
| `--channel <n>` | Fix a channel (without it, hops across the supported ones). |
| `--band <2.4\|5\|6\|all>` | Band when hopping channels. |
| `--hop-ms <ms>` | Time on each channel (default 350). |
| `--seconds <n>` | Stop after N seconds (default: until Ctrl+C). |
| `--out <file.pcap>` | Save captured frames. |
| `--crack <dictionary>` | After capturing, try to crack the first handshake. |
| `--json` | Print only the final JSON. |
Shows networks (APs), clients and handshakes seen (4-way and PMKID).
## `analyze` — read a `.pcap` offline
```bash
sabia analyze <file.pcap> [--json]
```
## `crack` — dictionary cracking
```bash
sabia crack <file.pcap> --wordlist <list.txt> [--bssid <mac>] [--station <mac>] [--rules] [--json]
```
Recomputes the PMK with PBKDF2-HMAC-SHA1 and checks the MIC (4-way) or the PMKID, for WPA/WPA2-PSK. `--bssid`/`--station` filter which handshake to use. `--rules` applies hashcat-style mutations (uppercase, numeric/symbol suffixes, simple leet) to each dictionary word — multiplies the time for real. The desktop app and `sabia ui` additionally offer the bundled 9.7M-password dictionary by default, mask brute force (`?d?l?u?s?a`), and `.hc22000` export.
## `deauth` — authorized deauthentication test
```bash
sudo sabia deauth <iface> --bssid <mac> [--station <mac>] [--count 5] [--reason 7] --yes
```
Without `--station`, the target is broadcast. The **`--yes`** flag confirms you are authorized to test this network — without it, the command refuses. It is recorded in the audit trail.
## `doctor` — diagnostics
```bash
sabia doctor [--json]
```
Checks privileges, tools (`iw`, `ip`) and monitor-capable interfaces.
## `audit` — audit trail
```bash
sabia audit verify [file] # check the hash-chain integrity
sabia audit show [--limit 20] # latest entries
```
## `update` — updating
```bash
sabia update # check for a new version
sabia update --apply # download, verify the SHA-256 and swap the executable
```
## `ui` — desktop/web interface
```bash
sabia ui [--port 4337] [--no-open]
```
Starts the local interface server and opens the browser (or not, with `--no-open`).