A session value under three layers of encoding
An export request carried a session parameter that looks like noise. Undo two layers of URL encoding by reading the % codes, then base64, and read the claims the server trusted.
Briefing
A report export of 88 KB went to an external IP using a session parameter instead of a cookie. The report service is supposed to require a signed token.
URL encoding turns = into %3D and % itself into %25, so %253D means it was encoded twice. Base64 strings often end in = or ==, which is a good clue for the last layer.
web-ws · Decoding artifacts
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.