This pack is self-contained: it ships its own collector, so you need no external service (no XSS Hunter / interactsh). Point every payload at:
/m04-p/collector?id=<your-unique-id>
Any resource load or script whose src/fetch hits that URL counts as an executing callback. A plain-text mention does not — it has to actually try to load, the way a browser would. Give each input its own id= so a returning callback tells you exactly which field fired. Example loader (choose your own unique id):
<img src="/m04-p/m04-p/collector?id=my-uniq-01">
You never see it fire — the callback on the Collector Log is your only proof.
The injection point here is a request header, not a form field. Every submission drags its User-Agent into an internal log viewer that staff render. Put your loader in the User-Agent header and submit — e.g. from the CLI:
curl -X POST /m04-p/naked/ua \ -H "User-Agent: <img src=/m04-p/collector?id=ua-01>"
The button below submits with your browser's own User-Agent — to exploit it you must control that header, so drive it from a proxy or the CLI.