Security testing with open source version of SoapUI

I would like to see the step by step procedure to do security testing using SoapUI. Many tutorials are available on-line but all of them explains the process in the paid version of SoapUI.

I'm stuck at the adding Parameters section where we need to specify the Label, Name and XPath. I've no idea how to specify the XPath in the parameters whether it is SQL injection, cross site scripting or any other security aspect testing. In the paid version it is possible to extract the parameters easily, but in OS version it is not possible. Please any one help me.