Browser Emulator
Built-in iframe sandbox for direct interaction with the challenge application
WXLWeb Exploitation Laboratory
Browser-based web exploitation challenge platform powered by WASM — no backend required, ready to run instantly
Skip to content
Terminal (wxlsh)
Built-in terminal with common pentest utilities such as curl, base64, and hex
Code Editor (Pyodide)
Python attack-script editor supporting the requests module and automated attacks
HTTP Repeater
Intercept and replay HTTP requests, freely modifying parameters to probe vulnerabilities
Network Traffic Log
Full HTTP request and response log for all tool panels, including status codes and timing
Pentest Notes
Markdown note system that records your operations and can export a full attack log
About WXL
WXL (Web Exploitation Laboratory) is a fully front-end Web security challenge platform powered by WebAssembly. Every challenge backend — Flask, FastAPI, PHP — runs entirely inside the browser, so realistic pentest practice needs zero server. Built-in HTTP Repeater, Python Code Editor, and a terminal emulator together provide a complete attack toolchain.
Platform Statistics
3
Total challenges
2
Easy
1
Medium
0
Hard
0
Mystery
Latest Challenges
Confidential Fileseasy
A PHP report viewer that builds a file path from the file parameter without sanitisation. Use ../ to escape the reports directory and read the flag.
May 31, 2026
Jwt None Algmedium
A Flask API whose JWT session check trusts the token's own alg header. Forge an unsigned (alg=none) admin token to reach /admin and read the flag.
May 31, 2026
Door Is Openeasy
A file-sharing app with an IDOR vulnerability — download other users' private files by manipulating the file ID.
Apr 2, 2026
Three Steps to Get Started
1
Pick a challenge
Open the challenges page and pick one by difficulty or category.
2
Use the tools
Use the built-in Browser, Terminal, Code Editor, and Repeater to analyse and exploit the vulnerability.
3
Submit the flag
Once you find the flag, paste it into the submit box on the challenge page to confirm your answer.