tool: http://code.google.com/p/xpath-blind-explorer/
video: http://penetration-testing.7safe.com/the-art-of-exploiting-lesser-known-injection-flaws-revealed-at-black-hat/
