ChopChop

ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.

Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file (by default: chopchop.yml), fully configurable, and especially by developers.

"Chop chop" is a phrase rooted in Cantonese. "Chop chop" means "hurry" and suggests that something should be done now and without delay.

Building
Usage
- Available flags
- Advanced usage
Creating a new check/signature
External Libraries
Talks
Licence
Authors

Building

We tried to make the build process painless and hopefully, it should be as easy as:

$ go mod install
$ go build .

There should be a resulting gochopchop binary in the folder.

Usage

We are continuously trying to make goChopChop as easy as possible. Scanning a host with this utility is as simple as :

$ ./gochopchop scan --url https://foobar.com

What's next

The Golang rewrite took place couple of months ago but there's so much to do, still. Here are some features we are planning to integrate :

Threading for better performance
Colors and better formatting
Ability to filter checks/signatures to search for
And much more!

Available flags

You can find the available flags here :

Flag	Full flag	Description
`-h`	`--help`	Help wizard
`-u`	`--url`	Set the target URL
`-i`	`--insecure`	Disable SSL Verification
`-c`	`--config-file`	Set a custom configuration file
`-f`	`--url-file`	Set a file containing a list of URLs
	`--csv`	Export results in CSV
	`--json`	Export results in JSON

Advanced usage

Here is a list of advanced usage that you mgiht be interested in. Note: Redirectors like > for post processing can be used.

Ability to scan and disable SSL verification

$ ./gochopchop scan --url https://foobar.com --insecure

Ability to scan with a custom configuration file (including custom plugins)

$ ./gochopchop scan --url https://foobar.com --insecure --config-file test_config.yml

Ability to list all the plugins or by severity : plugins or plugins --severity High

$ ./gochopchop plugins --severity High

Ability to block the CI pipeline by severity level (equal or over specified severity) : --block Medium

$ ./gochopchop scan --url https://foobar.com --insecure --block Medium

Ability to list all the plguins

$ ./gochopchop plugins

List High severity plugins

$ ./gochopchop plugins --severity High

Set a list or URLs located in a file

$ ./gochopchop scan --url-file url_file.txt

Export GoChopChop results in CSV and JSON format

$ ./gochopchop  scan --url https://foobar.com --json --csv

Creating a new check

Writing a new check is as simple as :

  - uri: "/.git/config"
    checks:
      - name: Git exposed
        match:
          - "[branch"
        remediation: Do not deploy .git folder on production servers
        description: Verifies that the GIT repository is accessible from the site
        severity: "High"

An URI (eg. /.git/config) is mapped to multiple checks which avoids sending X requests for X checks. Multiple checks can be done through a single HTTP request. Each check needs those fields:

Attribute	Type	Description	Optional ?	Example
name	string	Name of the check	No	Git exposed
description	string	A small description for the check	No	Ensure .git repository is not accessible from the webroot
remediation	string	Give a remediation for this specific "issue"	No	Do not deploy .git folder on production servers
severity	Enum("High", "Medium", "Low", "Informational")	Rate the criticity if it triggers in your environment	No	High
headers	List of string	List of headers there should be in the HTTP response	Yes	N/A
match	List of string	List the strings there should be in the HTTP response	Yes	"[branch"
no_match	List of string	List the strings there should NOT be in the HTTP response	Yes	N/A

External Libraries

Library Name	Link	License
Viper	https://github.com/spf13/viper	MIT License
Go-pretty	https://github.com/jedib0t/go-pretty	MIT License
Cobra	https://github.com/spf13/cobra	Apache License 2.0
strfmt	https://github.com/go-openapi/strfmt	Apache License 2.0
Go-homedir	https://github.com/mitchellh/go-homedir	MIT License
pkg-errors	https://github.com/pkg/errors	BSD 2 (Simplified License)
Go-runewidth	https://github.com/mattn/go-runewidth	MIT License

Please, refer to the third-party.txt file for further information.

Talks

PyCon FR 2019 (The tool was initially developed in Python) - https://docs.google.com/presentation/d/1uVXGUpt7tC7zQ1HWegoBbEg2LHamABIqfDfiD9MWsD8/edit

License

ChopChop has been released under Apache License 2.0. Please, refer to the LICENSE file for further information.

Authors

Paul A.
David R. (For the Python version)
Stanislas M. (For the Golang version)

KevinHock/ChopChop