Campaign export
Use the dashboard or CLI:victims array contains the target records and
victim_count reports their number. Each victim row includes identifiers,
session identifiers, client address and user agent data, and active state.
It does not contain the campaign event timeline,
screenshots, uploaded files, module results, or Firefox profiles. CSV is not
currently implemented.
Treat
campaign dump as an inventory or operational record, not as a complete
evidence archive.Browser-profile export
The dashboard’s per-session export first includes artifacts already stored for that victim session. When its live browser container is available, the backend also attempts a fresh Firefox-profile dump. If the container is unavailable or that dump fails, the export continues with stored artifacts only. A live Firefox profile is read as a bounded TAR stream and converted directly to a ZIP file on disk. The backend does not hold the complete TAR, ZIP, or a Base64 representation in memory. Archive paths and member types are validated and configured export limits are enforced. P-BitM excludes runtime configuration from the exported profile:user.js,
prefs.js, and the chrome/ directory. Firefox creates its local preferences
when the profile is opened, while cookies, site storage, history, and other
browser state remain available. It also removes extensions installed from the
campaign’s P-BitM developer-extension directory and their startup metadata;
other extensions already in the profile are retained. The campaign policy file
is not part of the profile export.