xpath-injection-testing
A security testing toolkit for detecting and mitigating XPath injection vulnerabilities.
Install
mkdir -p .claude/skills/xpath-injection-testing && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/6523" && unzip -o skill.zip -d .claude/skills/xpath-injection-testing && rm skill.zipInstalls to .claude/skills/xpath-injection-testing
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
XPath注入漏洞测试的专业技能和方法论Key capabilities
- →Identify XPath injection entry points in login and search functions
- →Execute boolean-based and time-based blind injection attacks
- →Bypass authentication using logical operators and comment injection
- →Extract XML node data through substring enumeration
- →Apply URL and HTML entity encoding to evade input filters
How it works
The skill identifies vulnerabilities where user input is directly concatenated into XPath queries, allowing attackers to manipulate query logic using operators like 'or' and 'and'. It then uses techniques such as boolean inference or time-based delays to extract data or bypass authentication checks.
Inputs & outputs
When to use xpath-injection-testing
- →Test login endpoints for injection
- →Validate xml data processing
- →Identify blind xpath vulnerability
- →Prevent authentication bypass
About xpath-injection-testing
Identifies entry points vulnerable to XPath injection by testing input handling. It provides payloads to check for logic bypass and information disclosure.
XPath注入漏洞测试的专业技能和方法论
When not to use it
- →Unauthorized environments without explicit testing permission
- →Systems where XPath queries are fully parameterized or use variable resolvers
Prerequisites
Limitations
- →Requires knowledge of the target application's XPath implementation
- →Dependent on the specific XPath version syntax supported by the target
How it compares
Unlike manual testing which requires guessing query structures, this method systematically uses XPath functions like substring() and count() to programmatically extract data from XML nodes.
Compared to similar skills
xpath-injection-testing side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| xpath-injection-testing (this skill) | 1 | 7mo | No flags | Intermediate |
| springboot-security | 5 | 5mo | No flags | Intermediate |
| deserialization-testing | 2 | 7mo | Review | Advanced |
| jar-audit-agent | 1 | 7mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Ed1s0nZ
View all by Ed1s0nZ →You might also like
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
deserialization-testing
Ed1s0nZ
反序列化漏洞测试的专业技能和方法论
jar-audit-agent
jar-analyzer
基于 jar-analyzer（SQLite + 内置 MCP）的证据驱动 Java 安全审计技能。核心目标：把“结论”变成“可复现证据 + 可度量覆盖率”。
ldap-injection-testing
Ed1s0nZ
LDAP注入漏洞测试的专业技能和方法论
jackson-security
benchflow-ai
Security considerations for Jackson JSON deserialization in Java applications. Covers timing of validation, raw input interception, and common deserialization attack patterns.
auth-implementation-patterns
sickn33
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.