Adapted the code to support a list of targets from a text file (Burp log file) or from a directory (WebScarab conversations folder) with command line option -l.

lib/core/common.py

@@ -97,7 +97,7 @@ def paramToDict(place, parameters=None):
             warnMsg  = "the testable parameter '%s' " % paramStr
             warnMsg += "you provided is not into the %s" % place
 
-        if conf.googleDork:
+        if conf.multipleTargets:
             warnMsg += ", skipping to next url"
 
         logger.warn(warnMsg)

lib/core/dump.py

@@ -219,7 +219,7 @@ class Dump:
             db = "All"
         table = tableValues["__infos__"]["table"]
 
-        if not conf.googleDork:
+        if not conf.multipleTargets:
             dumpDbPath = "%s%s%s" % (conf.dumpPath, os.sep, db)
 
             if not os.path.isdir(dumpDbPath):
@@ -259,7 +259,7 @@ class Dump:
                 blank = " " * (maxlength - len(column))
                 self.__write("| %s%s" % (column, blank), n=False)
 
-                if not conf.googleDork and field == fields:
+                if not conf.multipleTargets and field == fields:
                     dataToDumpFile(dumpFP, "\"%s\"" % column)
                 else:
                     dataToDumpFile(dumpFP, "\"%s\"," % column)
@@ -267,7 +267,7 @@ class Dump:
                 field += 1
 
         self.__write("|\n%s" % separator)
-        if not conf.googleDork:
+        if not conf.multipleTargets:
             dataToDumpFile(dumpFP, "\n")
 
         for i in range(count):
@@ -293,12 +293,12 @@ class Dump:
                     field += 1
 
             self.__write("|")
-            if not conf.googleDork:
+            if not conf.multipleTargets:
                 dataToDumpFile(dumpFP, "\n")
 
         self.__write("%s\n" % separator)
 
-        if not conf.googleDork:
+        if not conf.multipleTargets:
             dataToDumpFile(dumpFP, "\n")
             dumpFP.close()
 

lib/core/option.py

@@ -129,6 +129,48 @@ def __setGoogleDorking():
         raise sqlmapGenericException, errMsg
 
 
+def __feedTargetsDict(reqFile):
+    pass
+    #kb.targetUrls = googleObj.getTargetUrls()
+    #conf.data
+    #conf.cookie
+
+
+def __setMultipleTargets():
+    """
+    Define a configuration parameter if we are running in multiple target
+    mode.
+    """
+
+    listType = None
+
+    if conf.googleDork or conf.list:
+        conf.multipleTargets = True
+
+    if not conf.list:
+        return
+
+    if not os.path.exists(conf.list):
+        errMsg = "the specified list of target urls does not exist"
+        raise sqlmapFilePathException, errMsg
+
+    if os.path.isfile(conf.list):
+        __feedTargetsDict(conf.list)
+    elif os.path.isdir(conf.list):
+        files = os.listdir(conf.list)
+        files.sort()
+
+        for reqFile in files:
+            if not re.search("([\d]+)\-request", reqFile):
+                continue
+
+            __feedTargetsDict(reqFile)
+    else:
+        errMsg  = "the specified list of target urls is not a file "
+        errMsg += "nor a directory"
+        raise sqlmapFilePathException, errMsg
+
+
 def __setRemoteDBMS():
     """
     Checks and set the back-end DBMS option.
@@ -422,20 +464,21 @@ def __setConfAttributes():
     debugMsg = "initializing the configuration"
     logger.debug(debugMsg)
 
-    conf.cj           = None
-    conf.dbmsHandler  = None
-    conf.dumpPath     = None
-    conf.httpHeaders  = []
-    conf.hostname     = None
-    conf.loggedToOut  = None
-    conf.outputPath   = None
-    conf.paramDict    = {}
-    conf.parameters   = {}
-    conf.path         = None
-    conf.port         = None
-    conf.scheme       = None
-    conf.sessionFP    = None
-    conf.start        = True
+    conf.cj              = None
+    conf.dbmsHandler     = None
+    conf.dumpPath        = None
+    conf.httpHeaders     = []
+    conf.hostname        = None
+    conf.loggedToOut     = None
+    conf.multipleTargets = False
+    conf.outputPath      = None
+    conf.paramDict       = {}
+    conf.parameters      = {}
+    conf.path            = None
+    conf.port            = None
+    conf.scheme          = None
+    conf.sessionFP       = None
+    conf.start           = True
 
 
 def __setKnowledgeBaseAttributes():
@@ -462,7 +505,7 @@ def __setKnowledgeBaseAttributes():
     kb.injType        = None
     kb.parenthesis    = None
     kb.resumedQueries = {}
-    kb.targetUrls     = set()
+    kb.targetUrls     = {}
     kb.timeTest       = None
     kb.unionComment   = ""
     kb.unionCount     = None
@@ -582,6 +625,7 @@ def init(inputOptions=advancedDict()):
     __setHTTPProxy()
     __setThreads()
     __setRemoteDBMS()
+    __setMultipleTargets()
     __setGoogleDorking()
     __urllib2Opener()
 

lib/core/optiondict.py

@@ -28,6 +28,7 @@ optDict = {
             # Family:        { "parameter_name":    "parameter_datatype",
             "Request":       {
                                "url":               "string",
+                               "list":              "string",
                                "googleDork":        "string",
                                "testParameter":     "string",
                                "method":            "string",