Browser Emulator
Built-in iframe sandbox for direct interaction with the challenge application
WXLWeb Exploitation Laboratory
Browser-based web exploitation challenge platform powered by WASM — no backend required, ready to run instantly
Skip to content
Code Editor (Pyodide)
Python attack-script editor supporting the requests module and automated attacks
HTTP Repeater
Intercept and replay HTTP requests, freely modifying parameters to probe vulnerabilities
Network Traffic Log
Full HTTP request and response log for all tool panels, including status codes and timing
Pentest Notes
Markdown note system that records your operations and can export a full attack log
About WXL
WXL (Web Exploitation Laboratory) is a fully front-end Web security challenge platform powered by WebAssembly. Every challenge backend — Flask, FastAPI, PHP — runs entirely inside the browser, so realistic pentest practice needs zero server. A built-in HTTP Repeater, Python Code Editor, and Network Traffic Log together provide a complete attack toolchain.
Platform Statistics
4
Total challenges
3
Easy
1
Medium
0
Hard
0
Mystery
Latest Challenges
Selected Excerptsmedium
A white-box assessment of Kestrel Press's editorial workspace, where contributors draft teaching materials and curriculum editors assemble selected excerpts into a course pack.
Sep 13, 2026
Just a Previeweasy
A white-box engagement against Corvid Labs' internal prompt library, whose editor tells authors that rendering a preview runs in a restricted environment.
Sep 6, 2026
Staff Onlyeasy
A black-box engagement against Corkboard, an intranet noticeboard whose admin console is meant to open only for accounts carrying the administrator flag.
Aug 17, 2026
Three Steps to Get Started
1
Pick a challenge
Open the challenges page and pick one by difficulty or category.
2
Use the tools
Use the tools the challenge offers — Browser, Code Editor, Network Traffic Log, and Repeater — to analyse and exploit the vulnerability.
3
Submit the flag
Once you find the flag, paste it into the submit box on the challenge page to confirm your answer.