This pack is self-contained: it ships its own collector, so you need no external service (no XSS Hunter / interactsh). Point every payload at:
/m04-p/collector?id=<your-unique-id>
Any resource load or script whose src/fetch hits that URL counts as an executing callback. A plain-text mention does not — it has to actually try to load, the way a browser would. Give each input its own id= so a returning callback tells you exactly which field fired. Example loader (choose your own unique id):
<img src="/m04-p/m04-p/collector?id=my-uniq-01">
You never see it fire — the callback on the Collector Log is your only proof.
Realistic sink-hunting. This order form has many inputs — and several request headers ride along too. Only one of them is ever rendered inside a staff tool; the rest are stored, validated, indexed or filtered but never viewed. You do not know which. So do it the real way:
User-Agent and Referer, not just the form.id= (e.g. name-01, ship-01, ua-01).Tip: headers are inputs too. Replay this POST through a proxy or curl with -H "User-Agent: ..." and -H "Referer: ..." carrying their own tagged loaders, so you cover the full surface in one pass.