XCat is a tool for exploiting blind XPath injection flaws. While XPath injection flaws are not common they do turn up from time to time and XCat can be extremely helpful in exploring them.
Its useful in a pentest because it's "SQLMap for xpath flaws", allowing you to:
- Read arbitrary files on the filesystem (in any format, with some limitations)
- Make the server send portions of the document to XCat via HTTP, dramatically increasing retrieval times
- Retrieve the whole document being queried using standard blind injection techniques
Its also very lightweight and only has one dependency (Python-twisted). I wrote this tool as a companion to a blackhat paper I authored a year or so ago, and I figure that it might as well be included because there isn't much else that does what xcat does.
https://github.com/orf/xcat | 
