flopes/chopchop repository overview

⁠ChopChop

ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.

Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file (by default: chopchop.yml), fully configurable, and especially by developers.

⁠Table of Contents

• Building⁠
• Usage⁠
  • Available flags⁠
  • Advanced usage⁠
• Creating a new check/signature⁠
• External Libraries⁠
• Talks⁠
• Licence⁠
• Authors⁠

⁠Building

We tried to make the build process painless and hopefully, it should be as easy as:

$ go mod download
$ go build .

There should be a resulting gochopchop binary in the folder.

⁠Usage

We are continuously trying to make goChopChop as easy as possible. Scanning a host with this utility is as simple as :

$ ./gochopchop scan --url https://foobar.com

⁠What's next

The Golang rewrite took place a couple of months ago but there's so much to do, still. Here are some features we are planning to integrate :

• Threading for better performance
• Colors and better formatting
• Ability to filter checks/signatures to search for
• And much more!

⁠Available flags

You can find the available flags here :

⁠Advanced usage

Here is a list of advanced usage that you might be interested in. Note: Redirectors like > for post processing can be used.

• Ability to scan and disable SSL verification

$ ./gochopchop scan --url https://foobar.com --insecure

• Ability to scan with a custom configuration file (including custom plugins)

$ ./gochopchop scan --url https://foobar.com --insecure --config-file test_config.yml

• Ability to list all the plugins or by severity : plugins or plugins --severity High

$ ./gochopchop plugins --severity High

• Ability to block the CI pipeline by severity level (equal or over specified severity) : --block Medium

$ ./gochopchop scan --url https://foobar.com --insecure --block Medium

• Ability to list all the plugins

$ ./gochopchop plugins

• List High severity plugins

$ ./gochopchop plugins --severity High

• Set a list or URLs located in a file

$ ./gochopchop scan --url-file url_file.txt

• Export GoChopChop results in CSV and JSON format

$ ./gochopchop  scan --url https://foobar.com --json --csv 

⁠Creating a new check

Writing a new check is as simple as :

  - uri: "/.git/config"
    checks:
      - name: Git exposed
        match:
          - "[branch"
        remediation: Do not deploy .git folder on production servers
        description: Verifies that the GIT repository is accessible from the site
        severity: "High"

An URI (eg. /.git/config) is mapped to multiple checks which avoids sending X requests for X checks. Multiple checks can be done through a single HTTP request. Each check needs those fields:

⁠External Libraries

Please, refer to the third-party.txt file for further information.

⁠Talks

• PyCon FR 2019 (The tool was initially developed in Python) - https://docs.google.com/presentation/d/1uVXGUpt7tC7zQ1HWegoBbEg2LHamABIqfDfiD9MWsD8/edit⁠

⁠License

ChopChop has been released under Apache License 2.0. Please, refer to the LICENSE file for further information.

⁠Authors

• Paul A.
• David R. (For the Python version)
• Stanislas M. (For the Golang version)