Naked: display name

Setup — your in-lab collector

This pack is self-contained: it ships its own collector, so you need no external service (no XSS Hunter / interactsh). Point every payload at:

/m04-p/collector?id=<your-unique-id>

Any resource load or script whose src/fetch hits that URL counts as an executing callback. A plain-text mention does not — it has to actually try to load, the way a browser would. Give each input its own id= so a returning callback tells you exactly which field fired. Example loader (choose your own unique id):

<img src="/m04-p/m04-p/collector?id=my-uniq-01">

You never see it fire — the callback on the Collector Log is your only proof.