xpath

Advanced XPath injection scanner for authorized security testing.

Coded by Chokri Hammedi (blue0x1) · MIT Licensed

Overview

xpath is a fast, multi-technique XPath injection scanner written in Nim. It focuses on practical detection, response comparison, visible extraction, blind extraction, and payload coverage for real-world XML-backed applications.

It has no external runtime dependencies beyond the Nim standard library.

Capabilities

Installation

Nimble

nimble install xpath

This installs the latest package from the official Nim package list.

Build From Source

git clone https://github.com/blue0x1/xpath.git
cd xpath
make linux
make test

The Linux binary is written to:

dist/xpath-linux-amd64

Install System-Wide

sudo make install

By default this installs:

/usr/local/bin/xpath

To change the install prefix:

sudo make install PREFIX=/usr

Debian Package

make deb
sudo dpkg -i dist/xpath_1.0.0_amd64.deb

Windows Cross Build

make windows

The Windows binary is written to:

dist/xpath-windows-amd64.exe

On Linux, the Windows build requires MinGW:

sudo apt install mingw-w64

Quick Start

Scan a GET parameter:

xpath -u "http://target.local/search?q=test" -p q

Scan all detected query parameters:

xpath -u "http://target.local/search?q=test&id=1"

Scan a POST body:

xpath -u "http://target.local/login" -m POST -d "user=*&pass=test"

Run all techniques and extract visible or blind data when possible:

xpath -u "http://target.local/search?q=test" -p q -t A -x

Use a proxy:

xpath -u "http://target.local/search?q=test" -p q --proxy http://127.0.0.1:8080

Save JSON output:

xpath -u "http://target.local/search?q=test" -p q -t A -o report.json -f json

Usage

USAGE
  xpath [OPTIONS] -u <URL>

TARGET
  -u, --url <URL>           Target URL
  -m, --method <METHOD>     HTTP method: GET or POST
  -d, --data <DATA>         POST body, use * to mark injection point
  -p, --param <PARAM>       Parameter(s) to test, comma-separated
  -c, --cookie <COOKIE>     Cookie string
  -H, --header <HEADER>     Extra header, repeatable

DETECTION
  -t, --technique <FLAGS>   E, B, T, U, P, or A
  -l, --level <1-5>         Payload thoroughness level
  -x, --extract             Extract data after confirming injection
      --xpath <EXPR>        XPath expression for extraction

OUTPUT
  -o, --output <FILE>       Save report
  -f, --format <FMT>        text or json
  -v, --verbose             Verbose output

Techniques

Error-Based

Sends malformed XPath payloads and detects framework-specific error signatures from Java, .NET, PHP, libxml2, Saxon, Xalan, and W3C XQuery error codes.

xpath -u "http://target.local/item?id=1" -p id -t E

Boolean-Based Blind

Compares paired TRUE/FALSE payload responses using body similarity and size deltas. This is useful when results are not directly printed but application behavior changes.

xpath -u "http://target.local/search?q=test" -p q -t B

Time-Based Blind

Uses computationally expensive XPath expressions to create measurable response-time differences when content-based signals are unavailable.

xpath -u "http://target.local/search?q=test" -p q -t T --time-sec 3

Union / Node Selection

Tests whether a selector-like parameter can be unioned with absolute or relative XPath paths, such as //text(), ../../..//text(), //@*, and indexed paths.

xpath -u "http://target.local/search?q=INVALID&field=name" -p field -t U -x

Authentication Bypass

Checks predicate-breaking payloads, position-based payloads, role substring payloads, boolean functions, and context-aware bypass forms.

xpath -u "http://target.local/login" -m POST -d "username=*&password=test" -t P

Extraction

When -x is enabled, xpath chooses the best available extraction mode:

Example:

xpath -u "http://target.local/query?q=test" -p q -t A -x

Custom expression:

xpath -u "http://target.local/query?q=test" -p q -x --xpath "name(/*[1])"

Payload Levels

Build Targets

Project Layout

src/
  xpath.nim
  core/
    analyzer.nim
    crawler.nim
    extractor.nim
    http.nim
    payloads.nim
    reporter.nim
    scanner.nim
  utils/
    cli.nim
    config.nim
    logger.nim

License

MIT License. See LICENSE.

Legal Notice

This tool is for authorized security testing only. Use it only on systems you own or have explicit written permission to test.