Skip to content
Web eXploitation Laboratory
Main Navigation
Home
Challenges
Guide
Knowledge Base
English
繁體中文
English
繁體中文
Appearance
Return to top
Challenges
Choose a challenge to begin
All difficulties
Easy
Medium
Hard
Mystery
All categories
web
Sort: ID
Sort: Difficulty
Sort: Category
Sort: Date
↑
10 challenges
#001
Need to Know
easy
web
Apr 2, 2026
A black-box engagement against FileHub, a file-sharing service whose product page promises that a file uploaded by one account is readable only by that account.
idor
access-control
fastapi
sqlite
wxl.fhsh.taipei/c/001
#002
Staff Only
easy
web
Aug 17, 2026
A black-box engagement against Corkboard, an intranet noticeboard whose admin console is meant to open only for accounts carrying the administrator flag.
sql
injection
flask
sqlite
wxl.fhsh.taipei/c/002
#003
Do Not Crawl
easy
web
Aug 17, 2026
A black-box engagement against Shutterbox, a school photography club's site whose committee console sits on an address the club believes nobody can find.
information-disclosure
robots-txt
recon
flask
wxl.fhsh.taipei/c/003
#004
No Questions Asked
easy
web
Aug 22, 2026
A black-box engagement against Keyrack, a software licence reseller whose accounts can only ever spend the allowance Keyrack issued them.
e-commerce
licensing
black-box
authenticated
wxl.fhsh.taipei/c/004
#005
One Per Customer
easy
web
Aug 22, 2026
A black-box engagement against Stubhouse, a ticketing platform whose promotional codes are good for one use per customer and whose bookings are settled off-site.
ticketing
events
black-box
authenticated
wxl.fhsh.taipei/c/005
#006
Subject To Approval
easy
web
Aug 22, 2026
A black-box engagement against Badgeline, the access request system at a research institute, where a door code is meant to reach nobody who has not been endorsed and cleared.
facilities
research-institute
black-box
authenticated
wxl.fhsh.taipei/c/006
#007
Already Authenticated
easy
web
Sep 5, 2026
A white-box engagement against Northwind's incident console, whose operators are told that a restricted post-mortem is readable only by an account holding console rights.
access-control
authorization-bypass
middleware
fastapi
wxl.fhsh.taipei/c/007
#008
Just a Preview
easy
web
Sep 6, 2026
A white-box engagement against Corvid Labs' internal prompt library, whose editor tells authors that rendering a preview runs in a restricted environment.
ssti
template-injection
jinja2
fastapi
wxl.fhsh.taipei/c/008
#009
Plain Text Only
easy
web
Sep 6, 2026
A white-box engagement against Northmoor Utilities' billing portal, which tells account holders that what they enter is stored and printed as plain text.
ssti
template-injection
jinja2
flask
wxl.fhsh.taipei/c/009
#010
Selected Excerpts
medium
web
Sep 13, 2026
A white-box assessment of Kestrel Press's editorial workspace, where contributors draft teaching materials and curriculum editors assemble selected excerpts into a course pack.
idor
access-control
ssti
template-injection
jinja2
flask
wxl.fhsh.taipei/c/010