Downloads

The Downloads tab in Starkiller is where you keep track of every file you've pulled from a compromised system. Any time you run a module that downloads a file — whether it's a screenshot, a document, a password database, or an entire directory — that loot is stored and displayed here.

This tab gives you a visual interface to manage all the exfiltrated files during an engagement. Instead of manually digging through Empire’s directories or guessing where things went, Starkiller automatically logs the file name, the agent that pulled it, and when it was downloaded.

Let’s say you use the screenshot module, or you dump browser credentials, or maybe you grab some juicy documents from the user’s desktop — the results of those modules will appear here as downloadable entries. Each entry links directly to the file on your server, so you can download it to your own machine with a single click.

It’s a small feature, but it changes the workflow a lot. No more flipping between terminal and folders. Everything you grab during post-exploitation gets tracked, timestamped, and neatly listed — ready to analyze, report, or hand off.

And of course, the tab helps you stay organized. You can see which files came from which agents, keeping your operations clean and efficient, especially when you’re handling multiple compromised hosts at once.

If you’re planning to include screenshots in a report, pull a password-protected Excel file for cracking, or collect proof-of-compromise artifacts, the Downloads tab makes all of that super easy to manage.

Just like everything in Starkiller, it keeps the backend Empire logic intact — but wraps it in a visual layer that’s fast and intuitive.