XCat

Python package

XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities.

For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/

It supports an large number of features:

Auto-selects injections (run xcat injections for a list)
Detects the version and capabilities of the xpath parser and selects the fastest method of retrieval
Built in out-of-bound HTTP server
- Automates XXE attacks
- Can use OOB HTTP requests to drastically speed up retrieval
Custom request headers and body
Built in REPL shell, supporting:
- Reading arbitrary files
- Reading environment variables
- Listing directories
- Uploading/downloading files (soon TM)
Optimized retrieval
- Uses binary search over unicode codepoints if available
- Fallbacks include searching for common characters previously retrieved first
- Normalizes unicode to reduce the search space

Install

Run pip install xcat

Requires Python 3.7. You can easily install this with pyenv: pyenv install 3.7.1

There is a complete demo application you can use to explore the features of XCat. See the README here: https://github.com/orf/xcat_app

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

xcat-1.1.0.tar.gz (15.4 kB view details)

Uploaded May 20, 2020 Source

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

xcat-1.1.0-py3-none-any.whl (19.0 kB view details)

Uploaded May 20, 2020 Python 3

Details for the file xcat-1.1.0.tar.gz.

Details for the file xcat-1.1.0-py3-none-any.whl.

Hashes for xcat-1.1.0-py3-none-any.whl
Algorithm	Hash digest
SHA256	`626f53f3fca29f4ee29625af1a85225c15c45b8d27cbf0a718c0f7bcf900956d`
MD5	`da3fd132e63305220ce684f95f7aaa0a`
BLAKE2b-256	`866939ff89e2453d33b5bed02f48c91014051e88e734297505a8b62d305a31d7`