Browser Emulator
Built-in iframe sandbox for direct interaction with the challenge application
WXLWeb Exploitation Laboratory
Browser-based web exploitation challenge platform powered by WASM — no backend required, ready to run instantly
Skip to content
Code Editor (Pyodide)
Python attack-script editor supporting the requests module and automated attacks
HTTP Repeater
Intercept and replay HTTP requests, freely modifying parameters to probe vulnerabilities
Network Traffic Log
Full HTTP request and response log for all tool panels, including status codes and timing
Pentest Notes
Markdown note system that records your operations and can export a full attack log
About WXL
WXL (Web Exploitation Laboratory) is a fully front-end Web security challenge platform powered by WebAssembly. Every challenge backend — Flask, FastAPI, PHP — runs entirely inside the browser, so realistic pentest practice needs zero server. A built-in HTTP Repeater, Python Code Editor, and Network Traffic Log together provide a complete attack toolchain.
Platform Statistics
6
Total challenges
6
Easy
0
Medium
0
Hard
0
Mystery
Latest Challenges
Subject To Approvaleasy
A black-box engagement against Badgeline, the access request system at a research institute, where a door code is meant to reach nobody who has not been endorsed and cleared.
Aug 22, 2026
One Per Customereasy
A black-box engagement against Stubhouse, a ticketing platform whose promotional codes are good for one use per customer and whose bookings are settled off-site.
Aug 22, 2026
No Questions Askedeasy
A black-box engagement against Keyrack, a software licence reseller whose accounts can only ever spend the allowance Keyrack issued them.
Aug 22, 2026
Three Steps to Get Started
1
Pick a challenge
Open the challenges page and pick one by difficulty or category.
2
Use the tools
Use the tools the challenge offers — Browser, Code Editor, Network Traffic Log, and Repeater — to analyse and exploit the vulnerability.
3
Submit the flag
Once you find the flag, paste it into the submit box on the challenge page to confirm your answer.