This paper describes a Blind XPath Injection attack that enables an attacker to extract a complete XML document used for XPath querying, without prior knowledge of the XPath query.
You can download it from the following link: https://packetstormsecurity.com/files/download/33380/Blind_XPath_Injection_20040518.pdf
Source: https://packetstormsecurity.com/files/33380/Blind_XPath_Injection_20040518.pdf.html