sabia/README.md

<p align="center"><img src="apps/gui/ui/sabia.png" width="300" alt="Sabiá"></p>
<h1 align="center">Sabiá</h1>
<p align="center">Free and open Wi-Fi auditing.<br>Terminal and desktop app · live capture on Linux, offline analysis on Windows, Linux and macOS · authorized use.</p>

<p align="center"><a href="docs/cli.md">Terminal</a> · <a href="docs/interface.md">Interface</a> · <a href="docs/architecture.md">Architecture</a> · <a href="ROADMAP.md">Roadmap</a> · <a href="CHANGELOG.md">Changelog</a></p>

<p align="center"><b>English</b> · <a href="README.pt-BR.md">Português</a></p>

---

Sabiá brings together, in a single sweep, what tools like `airodump-ng`, `hcxdumptool`, `aircrack-ng` and `wifite` do separately — in one Rust binary, with no `libpcap` dependency:

- **Network discovery:** hops across the **2.4, 5 and 6 GHz** channels and lists access points and associated clients, with SSID, BSSID, channel, signal and security type.
- **Monitor mode without scripts:** turns the card's monitor mode on and off straight through netlink/`iw`, and shows which channels the radio supports.
- **Handshake capture:** recognizes the **4-way handshake (EAPOL)** and the **PMKID** on the air and keeps only what offline cracking needs.
- **Offline dictionary cracking:** recomputes the PMK with **PBKDF2-HMAC-SHA1** and checks the **MIC** (4-way) or the **PMKID** (`HMAC-SHA1(PMK, "PMK Name" …)`) — for WPA/WPA2-PSK.
- **pcap round-trip:** writes captured frames to `.pcap` and **analyzes a `.pcap` offline** (networks, clients and handshakes), interoperable with the other tools.
- **Deauthentication test:** sends _deauth_ to an AP/station to force a reassociation — only with an explicit authorization confirmation (`--yes`).
- **Audit trail:** every monitor-mode activation and capture session is recorded in a local **hash-chained** trail.
- **Diagnostics:** `doctor` checks privileges, tools and interfaces before you start.

## Authorized use

Sabiá is an **auditing** tool — for testing the security of networks you **own** or have **explicit authorization** to assess.

- Capturing handshakes, sending deauthentication or cracking passwords on third-party networks **without permission is illegal** in most countries. The responsibility is the operator's.
- Deauthentication (`deauth`) requires the `--yes` flag, an assertion that you are authorized to test that network.
- Every monitor-mode activation and capture session is **recorded in the local audit trail** (`sabia audit show`), hash-chained to detect tampering.
- **Nothing of yours leaves the machine.** The only network access by default is the update check on startup (which can be disabled).
- Dictionary passwords and handshakes stay on your machine.

## Install

Download the package for your system from **[Releases](../../releases)**:

| | CLI | Desktop app |
|---|---|---|
| Windows | `sabia-*-windows-x86_64.zip` | `.msi` / `.exe` installer |
| macOS | `sabia-*-macos-{aarch64,x86_64}.tar.gz` | `.dmg` |
| Linux | `sabia-*-linux-{x86_64,aarch64}.tar.gz` | `.AppImage` / `.deb` |

Each file has a `.sha256` next to it. Build from source: `cargo build --release -p sabia-cli` (Rust 1.80+).

**Updates:** the desktop app checks GitHub on startup; when a new version exists, a button offers **Update now**: it downloads the right binary for your platform, verifies the **SHA-256** and swaps the running executable — no manual download. The check is a single request to the releases API and sends nothing of yours.

> The binaries are **not signed yet**: Windows SmartScreen and macOS Gatekeeper will warn. Check the SHA-256.

**Capture and monitor mode require Linux and root** (`CAP_NET_ADMIN`/`CAP_NET_RAW`): raw capture uses `AF_PACKET` and interface control uses netlink. **Offline `.pcap` analysis and cracking** also run on Windows and macOS. The desktop app elevates to administrator on its own at startup.

## Getting started

```bash
sabia doctor                              # privileges, tools and interfaces
sabia iface list                          # Wi-Fi interfaces and their modes
sudo sabia iface monitor wlan0 on         # enable monitor mode

sudo sabia scan wlan0 --band all --out air.pcap # hop channels and record the air
sabia analyze air.pcap                      # read a .pcap offline
sabia crack air.pcap --wordlist list.txt    # crack the handshake by dictionary
```

Authorized deauthentication testing and all other commands (`audit`, `update`, `ui`) are in **[docs/cli.md](docs/cli.md)**.

## Desktop app

Desktop app (Tauri) with an interface sidebar, a capture panel with an animated signal line, and a networks table with signal bars and color-coded security badges. The same front-end runs in the browser with `sabia ui`. More in **[docs/interface.md](docs/interface.md)**.

- Pick the interface, toggle **monitor mode** and start/stop **capture** by button.
- Live **networks seen** table, with signal, channel and security.
- An **authorized-use** notice always in view and automatic privilege elevation on startup.
- One-click **update** button, **Auto, Light and Dark** themes and interface in **Portuguese and English**.

## Known limits

- **Capture is Linux-only**, with a card that supports **monitor mode** (and injection, for `deauth`). On Windows and macOS Sabiá only does `.pcap` analysis and offline cracking.
- **WPA3/SAE** does not fall to handshake dictionaries — cracking covers **WPA/WPA2-PSK** (4-way and PMKID).
- **5 and 6 GHz** depend on the card and the regulatory domain; some channels stay passive (no probing).
- **Passwords outside the dictionary don't come back:** cracking is dictionary force only, no rules or masks yet.
- **Windows and macOS:** the code compiles and is tested in CI, but live capture does not run on those platforms.

## Where it's going

Summary of the [ROADMAP](ROADMAP.md):

| | |
|---|---|
| **Done** | Monitor mode via netlink, 2.4/5/6 GHz scanning, 4-way and PMKID capture, `.pcap` read/write, dictionary cracking (WPA/WPA2-PSK), authorized `deauth`, hash-chained audit trail, `doctor`, CLI + desktop app, one-click update |
| **Next** | Rules and masks in cracking, GPU acceleration, export to the hashcat format (`22000`) |
| **Later** | WPS attack, rogue AP / evil twin for authorized testing, capture on Windows (Npcap) |
| **Long term** | WPA3/SAE downgrade, validation on varied hardware |

## Development

```
crates/sabia-core   core: interfaces, netlink, radiotap, 802.11, EAPOL, handshake, capture, crack, audit, update
crates/sabia-cli    the `sabia` binary (CLI + local UI server)
apps/gui            interface (ui/ = HTML, CSS and JS; src-tauri/ = desktop app)
scripts/            CI helpers (cached dependency install, i18n coverage check)
docs/               terminal, interface and architecture
```

```bash
cargo test --workspace
cargo clippy --workspace --all-targets
node scripts/check-ui-i18n.mjs        # UI translation coverage
```

See [CONTRIBUTING.md](CONTRIBUTING.md) and [docs/architecture.md](docs/architecture.md). Versions follow [SemVer](https://semver.org/); changes in [CHANGELOG.md](CHANGELOG.md). To release: `git tag vX.Y.Z && git push --tags` (the `release` workflow builds and publishes everything). Vulnerabilities: [SECURITY.md](SECURITY.md).

## License

[MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), your choice.