Web eXploitation Laboratory

Challenges

Choose a challenge to begin

3 challenges

#001Confidential FileseasywebMay 31, 2026

A PHP report viewer that builds a file path from the file parameter without sanitisation. Use ../ to escape the reports directory and read the flag.

path-traversalaccess-controllfiphp

#002Door Is OpeneasywebApr 2, 2026

A file-sharing app with an IDOR vulnerability — download other users' private files by manipulating the file ID.

idoraccess-controlfastapisqlite

#003Jwt None AlgmediumwebMay 31, 2026

A Flask API whose JWT session check trusts the token's own alg header. Forge an unsigned (alg=none) admin token to reach /admin and read the flag.

jwtaccess-controlauthenticationflask