University classroom lab

From ?order= to a generated XML payload

A realistic, isolated reconstruction of a dynamic krpano-style include, Base64 decoding, JavaScript navigation, campaign routing, and final landing page. Every request is confined to this local Express process.

Open Inspector Mode Run Realistic Mode View raw XML Presentation mode

Server-side meaning

GET /payload?order=1gjN2u
              ↓
campaigns["1gjN2u"]
              ↓
JavaScript already contains id=1gjN2u
              ↓
Base64 → XML response

Hard safety boundary

Hosts, origins, referrers, include URLs, and generated destinations are validated. Remote schemes, protocol-relative URLs, and unrecognized campaign IDs are rejected.

Bound address: 127.0.0.1
Allowed hosts: localhost, 127.0.0.1
Allowed include: /payload?order=…

Exact classroom visualization

1. CRAFTED VIEWER REQUEST<include url="/payload?order=1gjN2u">
↓
2. PAYLOAD SERVERorder = 1gjN2u → campaign lookup → generated JavaScript
↓
Base64 encodingwindow.location.href = "/go/…&id=1gjN2u"
↓
3. KRPANO XML<layer onloaded="…"> → atob() → eval()
↓
4. LOCAL ROUTERid = 1gjN2u
↓
5. LOCAL LANDING PAGE

Same endpoint, different orders

same endpoint + different order = different campaign configuration = different generated JavaScript = different Base64 = different destination

OrderDecoded destinationBase64 sampleInspect
Loading local campaign data…
Full-screen friendly

Presentation mode

Crafted XML
Include request
Order extraction
Campaign lookup
JS generation
Base64 encoding
XML generation
Layer loading
Base64 decoding
JS execution
Router navigation
Final landing page

Ready.