Skip to content
Web eXploitation Laboratory
Main Navigation
Home
Challenges
Guide
English
繁體中文
English
繁體中文
Appearance
Return to top
Challenges
Choose a challenge to begin
All difficulties
Easy
Medium
Hard
Mystery
All categories
web
Sort: ID
Sort: Difficulty
Sort: Category
Sort: Date
↑
4 challenges
#001
Need to Know
easy
web
Apr 2, 2026
A black-box engagement against FileHub, a file-sharing service whose product page promises that a file uploaded by one account is readable only by that account.
idor
access-control
fastapi
sqlite
wxl.browserlab.online/c/001
#002
Staff Only
easy
web
Aug 17, 2026
A black-box engagement against Corkboard, an intranet noticeboard whose admin console is meant to open only for accounts carrying the administrator flag.
sql
injection
flask
sqlite
wxl.browserlab.online/c/002
#008
Just a Preview
easy
web
Sep 6, 2026
A white-box engagement against Corvid Labs' internal prompt library, whose editor tells authors that rendering a preview runs in a restricted environment.
ssti
template-injection
jinja2
fastapi
wxl.browserlab.online/c/008
#010
Selected Excerpts
medium
web
Sep 13, 2026
A white-box assessment of Kestrel Press's editorial workspace, where contributors draft teaching materials and curriculum editors assemble selected excerpts into a course pack.
idor
access-control
ssti
template-injection
jinja2
flask
wxl.browserlab.online/c/010