UI Walkthrough¶

A guided tour of the Stentor operator interface -- from the sidebar navigation to the cockpit workspace where you interact with beacons in real time.

Stentor uses a single-page React application with a collapsible sidebar for navigation and a central content area that adapts to each page. The interface supports both dark and light mode (toggle in the top-right of any page), is mobile-responsive, and includes a command palette for fast navigation.

Sidebar Navigation¶

The sidebar is organized into five groups that mirror the operator workflow: operate, manage what you deploy, collect intelligence, report findings, and configure the system.

Operate¶

Day-to-day operational pages for running engagements.

Manage¶

Configure and deploy the tools and infrastructure used during an engagement.

Collect¶

View intelligence gathered from compromised targets.

Report¶

Generate engagement deliverables.

System¶

Platform configuration and administration.

Live Count Badges¶

Several sidebar items display live count badges showing real-time data:

• Cockpit -- number of active beacons
• Listeners -- number of running listeners
• Targets -- total discovered targets
• Services -- total discovered services
• Credentials -- total harvested credentials
• Downloads -- total downloaded files
• Keystrokes -- total keystroke captures
• Screenshots -- total captured screenshots

These counts update automatically via a single consolidated API call, so you always have situational awareness at a glance.

The Cockpit¶

The cockpit is the primary operator workspace -- the page you will spend most of your time on during an engagement. It provides a two-panel resizable layout: a topology view on top and an interactive console on the bottom.

Topology View¶

The top panel offers two view modes, toggled via the graph/list buttons in the cockpit header:

Graph View (Pivot Graph)

A visual network topology powered by React Flow. Machines appear as interactive nodes connected by edges representing network relationships. Compromised machines display beacon indicators, and the graph updates in real time as beacons check in or go offline.

• Click a node to select it and view its details
• Right-click (or double-click) a node to open the context menu -- a full operational command palette with 12 technique categories, real-time search, favorites, and OPSEC risk indicators. See the Context Menu Guide for complete documentation
• Drag nodes to rearrange the layout
• Multi-select nodes for batch operations
• The layout strategy can be switched between hierarchy and other arrangements

Table View (Beacon Table)

A tabular list of all beacons with sortable columns showing hostname, username, PID, integrity level, OS, internal/external IP, sleep interval, and last check-in time. Right-click any row to access the same context menu as the graph view.

Interactive Console¶

The bottom panel is a tabbed console interface where you interact with beacons and view operational events.

Shell Tabs

Each beacon shell opens in its own tab. Type commands directly into the terminal-style input, and output appears inline with timestamps and task status indicators. Multiple shell tabs can be open simultaneously, and you can drag-and-drop tabs to reorder them.

Common shell commands include ls, ps, pwd, download, upload, screenshot, hashdump, mimikatz, and dozens more. Tab completion helps you discover available commands.

Special Tabs

The context menu can open specialized tabs beyond the basic shell:

• Files -- graphical file browser for the target machine
• Processes -- live process list with filtering and injection options
• Desktop -- VNC-style remote desktop view of the target
• SOCKS -- SOCKS proxy tunnel management
• Port Forwards -- port forwarding configuration

Event Log

A dedicated event log tab shows operational events across all beacons: new check-ins, completed tasks, errors, and system notifications. This provides a unified timeline of engagement activity.

Cockpit Header¶

The header bar across the top of the cockpit shows:

• Connection status -- a pulsing indicator showing whether the relay WebSocket is online or offline
• View toggle -- switch between graph and table view
• Beacon count -- total active beacons across all targets
• Target count -- total discovered machines in the topology

Command Palette¶

Press Cmd+K (macOS) or Ctrl+K (Windows/Linux) from any page to open the command palette.

The command palette provides:

• Quick navigation -- type a page name to jump directly to it (e.g., "listeners", "scripts", "cockpit")
• Command execution -- run actions without navigating to the relevant page
• Search -- find beacons, targets, listeners, and other entities by name or property

The search bar in the sidebar (visible when the sidebar is expanded) also opens the command palette when clicked.

Keyboard Shortcuts¶

Stentor supports Vim-style keyboard shortcuts for fast navigation without reaching for the mouse.

Navigation shortcuts use a two-key sequence starting with G:

Dashboard¶

The Dashboard is the landing page after login. It provides an operational summary showing:

• Active beacon count and recent check-in activity
• Running listener status
• Recent tasks and their outcomes
• Quick links to common actions (create listener, generate payload, open cockpit)

Think of the Dashboard as your morning briefing -- a quick snapshot of the engagement state before diving into the Cockpit.

Multi-Server Mode¶

When you connect to two or more Stentor servers simultaneously, a server switch bar appears at the bottom of the screen. This enables distributed operations -- managing multiple independent C2 servers from a single browser session.

Each server connection is independent with its own beacons, listeners, and data. The switch bar lets you toggle the active server context, and the cockpit, shell commands, and API calls route to whichever server is currently selected.

Next Steps¶

Now that you know your way around the interface, learn how the underlying C2 platform works:

• Core Concepts -- understand beacons, listeners, relays, and the C2 lifecycle
• Listeners & Transports -- set up your first listener