Web eXploitation Laboratory

Challenges

Choose a challenge to begin

6 challenges

#001Do Not CrawleasywebAug 17, 2026

A black-box engagement against Shutterbox, a school photography club's site whose committee console sits on an address the club believes nobody can find.

information-disclosurerobots-txtreconflask

#002Need to KnoweasywebApr 2, 2026

A black-box engagement against FileHub, a file-sharing service whose product page promises that a file uploaded by one account is readable only by that account.

idoraccess-controlfastapisqlite

#003No Questions AskedeasywebAug 22, 2026

A black-box engagement against Keyrack, a software licence reseller whose accounts can only ever spend the allowance Keyrack issued them.

e-commercelicensingblack-boxauthenticated

#004One Per CustomereasywebAug 22, 2026

A black-box engagement against Stubhouse, a ticketing platform whose promotional codes are good for one use per customer and whose bookings are settled off-site.

ticketingeventsblack-boxauthenticated

#005Staff OnlyeasywebAug 17, 2026

A black-box engagement against Corkboard, an intranet noticeboard whose admin console is meant to open only for accounts carrying the administrator flag.

sqlinjectionflasksqlite

#006Subject To ApprovaleasywebAug 22, 2026

A black-box engagement against Badgeline, the access request system at a research institute, where a door code is meant to reach nobody who has not been endorsed and cleared.

facilitiesresearch-instituteblack-boxauthenticated