blue0x1/xpathxpath is a fast, multi-technique XPath injection scanner written in Nim. It focuses on practical detection, response comparison, visible extraction, blind extraction.
Advanced XPath injection scanner for authorized security testing.
Coded by Chokri Hammedi (blue0x1) · MIT Licensed
xpath is a fast, multi-technique XPath injection scanner written in Nim. It focuses on practical detection, response comparison, visible extraction, blind extraction, and payload coverage for real-world XML-backed applications.
It has no external runtime dependencies beyond the Nim standard library.
nimble install xpath
This installs the latest package from the official Nim package list.
git clone https://github.com/blue0x1/xpath.git
cd xpath
make linux
make test
The Linux binary is written to:
dist/xpath-linux-amd64
sudo make install
By default this installs:
/usr/local/bin/xpath
To change the install prefix:
sudo make install PREFIX=/usr
make deb
sudo dpkg -i dist/xpath_1.0.0_amd64.deb
make windows
The Windows binary is written to:
dist/xpath-windows-amd64.exe
On Linux, the Windows build requires MinGW:
sudo apt install mingw-w64
Scan a GET parameter:
xpath -u "http://target.local/search?q=test" -p q
Scan all detected query parameters:
xpath -u "http://target.local/search?q=test&id=1"
Scan a POST body:
xpath -u "http://target.local/login" -m POST -d "user=*&pass=test"
Run all techniques and extract visible or blind data when possible:
xpath -u "http://target.local/search?q=test" -p q -t A -x
Use a proxy:
xpath -u "http://target.local/search?q=test" -p q --proxy http://127.0.0.1:8080
Save JSON output:
xpath -u "http://target.local/search?q=test" -p q -t A -o report.json -f json
USAGE
xpath [OPTIONS] -u <URL>
TARGET
-u, --url <URL> Target URL
-m, --method <METHOD> HTTP method: GET or POST
-d, --data <DATA> POST body, use * to mark injection point
-p, --param <PARAM> Parameter(s) to test, comma-separated
-c, --cookie <COOKIE> Cookie string
-H, --header <HEADER> Extra header, repeatable
DETECTION
-t, --technique <FLAGS> E, B, T, U, P, or A
-l, --level <1-5> Payload thoroughness level
-x, --extract Extract data after confirming injection
--xpath <EXPR> XPath expression for extraction
OUTPUT
-o, --output <FILE> Save report
-f, --format <FMT> text or json
-v, --verbose Verbose output
Sends malformed XPath payloads and detects framework-specific error signatures from Java, .NET, PHP, libxml2, Saxon, Xalan, and W3C XQuery error codes.
xpath -u "http://target.local/item?id=1" -p id -t E
Compares paired TRUE/FALSE payload responses using body similarity and size deltas. This is useful when results are not directly printed but application behavior changes.
xpath -u "http://target.local/search?q=test" -p q -t B
Uses computationally expensive XPath expressions to create measurable response-time differences when content-based signals are unavailable.
xpath -u "http://target.local/search?q=test" -p q -t T --time-sec 3
Tests whether a selector-like parameter can be unioned with absolute or relative XPath paths, such as //text(), ../../..//text(), //@*, and indexed paths.
xpath -u "http://target.local/search?q=INVALID&field=name" -p field -t U -x
Checks predicate-breaking payloads, position-based payloads, role substring payloads, boolean functions, and context-aware bypass forms.
xpath -u "http://target.local/login" -m POST -d "username=*&password=test" -t P
When -x is enabled, xpath chooses the best available extraction mode:
| Mode | Description |
|---|---|
| Visible auth response |
Example:
xpath -u "http://target.local/query?q=test" -p q -t A -x
Custom expression:
xpath -u "http://target.local/query?q=test" -p q -x --xpath "name(/*[1])"
src/
xpath.nim
core/
analyzer.nim
crawler.nim
extractor.nim
http.nim
payloads.nim
reporter.nim
scanner.nim
utils/
cli.nim
config.nim
logger.nim
MIT License. See LICENSE.
This tool is for authorized security testing only. Use it only on systems you own or have explicit written permission to test.
| Area | Support |
|---|
| Detection | Error-based, boolean-based blind, time-based blind, auth bypass, union/node-selection |
| Extraction | Visible HTML parsing, selector union extraction, blind XPath data extraction |
| Payloads | Classic, predicate, function-based, path breakout, encoded, entity, mixed-case variants |
| Discovery | URL parameter detection and HTML form crawling |
| Evasion | WAF/IDS indicators, URL-encoded and entity-based bypass payloads |
| Output | Human-readable terminal report and JSON report export |
| Transport | Cookies, headers, proxy, retry, timeout, User-Agent, redirect controls |
| Parses new rows, links, redirects, and rendered values from successful bypass responses |
| Visible union paths | Extracts newly rendered text from union/node-selection payloads |
| Blind extraction | Uses string-length(), substring(), name(), and count() to infer XML data |
| Level | Focus |
|---|
1 | Fast classic payloads |
2 | Common real-world predicate breaks |
3 | Default balanced scan |
4 | Encoded, entity, and path-breakout payloads |
5 | Maximum coverage and exotic variants |
| Target | Output |
|---|
make linux | dist/xpath-linux-amd64 |
make windows | dist/xpath-windows-amd64.exe |
make test | Runs the Nim test suite |
make install | Installs to $(PREFIX)/bin/xpath |
make deb | dist/xpath_1.0.0_amd64.deb |
make clean | Removes build/ and dist/ |