prongedfork/chopchop

ChopChop is a CLI to help developers scanning endpoints and identifying exposition of sensitive services/files/folders.

ChopChop

ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.

Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file (by default: chopchop.yml), fully configurable, and especially by developers.

"Chop chop" is a phrase rooted in Cantonese. "Chop chop" means "hurry" and suggests that something should be done now and without delay.

---

Table of Contents

• Building
• Usage
  • Available flags
  • Advanced usage
• Creating a new check/signature
• External Libraries
• Talks
• Licence
• Authors

Building

We tried to make the build process painless and hopefully, it should be as easy as:

$ go mod download
$ go build .

There should be a resulting gochopchop binary in the folder.

Using Docker

Thanks to Github Container Registry, we are able to provide you some freshly-build Docker images!

docker run ghcr.io/michelin/gochopchop scan -u https://foobar.com --verbose

But if you prefer, you can also build it locally, see below:

Build locally

docker build -t gochopchop .

Usage

We are continuously trying to make goChopChop as easy as possible. Scanning a host with this utility is as simple as :

$ ./gochopchop scan --url https://foobar.com

Using Docker

docker run gochopchop scan --url https://foobar.com

Custom configuration file

docker run -v ./:/app chopchop scan -c /app/chopchop.yml --url https://foobar.com

What's next

The Golang rewrite took place a couple of months ago but there's so much to do, still. Here are some features we are planning to integrate :

• Threading for better performance
• Colors and better formatting
• Ability to filter checks/signatures to search for
• And much more!

Available flags

You can find the available flags available for the scan command :

Flag	Full flag	Description
-b	--block <string>	Block pipeline if severity is over or equal specified flag
-h	--help	Help wizard
-u	--url <string>	Set the target URL
-i	--insecure	Disable SSL Verification
-c	--config-file <string>	Set a custom configuration file
-f	--url-file <string>	Set a file containing a list of URLs
-p	--prefix <string>	Add prefix to urls when flag url-file is specified
-s	--suffix <string>	Add suffix to urls when flag url-file is specified
-t	--timeout <integer>	Timeout for the HTTP requests (default: 10s)
-v	--verbose	Verbose mode
	--csv	Export results in CSV
	--json	Export results in JSON
	--csv-file <string>	Filename for the CSV export
	--json-file <string>	Filename for the JSON export

Advanced usage

Here is a list of advanced usage that you might be interested in. Note: Redirectors like > for post processing can be used.

• Ability to scan and disable SSL verification

$ ./gochopchop scan --url https://foobar.com --insecure

• Ability to scan with a custom configuration file (including custom plugins)

$ ./gochopchop scan --url https://foobar.com --insecure --config-file test_config.yml

• Ability to list all the plugins or by severity : plugins or plugins --severity High

$ ./gochopchop plugins --severity High

• Ability to block the CI pipeline by severity level (equal or over specified severity) : --block Medium

$ ./gochopchop scan --url https://foobar.com --insecure --block Medium

• Ability to specify specific signatures to be checked

./gochopchop scan -u https://foobar.com --timeout 1 --verbose --csv --csv-file boo.csv --signature-name "Git,Zimbra,Jenkins"

• Ability to list all the plugins

$ ./gochopchop plugins

• List High severity plugins

$ ./gochopchop plugins --severity High

• Set a list or URLs located in a file

$ ./gochopchop scan --url-file url_file.txt

• Export GoChopChop results in CSV and JSON format

$ ./gochopchop  scan --url https://foobar.com --json --csv --csv-file results.csv --json-file results.json

Creating a new check

Writing a new check is as simple as :

  - uri: "/.git/config"
    checks:
      - name: Git exposed
        match:
          - "[branch"
        remediation: Do not deploy .git folder on production servers
        description: Verifies that the GIT repository is accessible from the site
        severity: "High"

An URI (eg. /.git/config) is mapped to multiple checks which avoids sending X requests for X checks. Multiple checks can be done through a single HTTP request. Each check needs those fields:

Attribute	Type	Description	Optional ?	Example
name	string	Name of the check	No	Git exposed
description	string	A small description for the check	No	Ensure .git repository is not accessible from the webroot
remediation	string	Give a remediation for this specific "issue"	No	Do not deploy .git folder on production servers
severity	Enum("High", "Medium", "Low", "Informational")	Rate the criticity if it triggers in your environment	No	High
status_code	integer	The HTTP status code that should be returned	Yes	200
headers	List of string	List of headers there should be in the HTTP response	Yes	N/A
match	List of string	List the strings there should be in the HTTP response	Yes	"[branch"
no_match	List of string	List the strings there should NOT be in the HTTP response	Yes	N/A
query_string	GET parameters that have to be passed to the endpoint	String	Yes	query_string: "id=FOO-chopchoptest"

External Libraries

Library Name	Link	License
Viper	https://github.com/spf13/viper	MIT License
Go-pretty	https://github.com/jedib0t/go-pretty	MIT License
Cobra	https://github.com/spf13/cobra	Apache License 2.0
strfmt	https://github.com/go-openapi/strfmt	Apache License 2.0
Go-homedir	https://github.com/mitchellh/go-homedir	MIT License
pkg-errors	https://github.com/pkg/errors	BSD 2 (Simplified License)
Go-runewidth	https://github.com/mattn/go-runewidth	MIT License

Please, refer to the third-party.txt file for further information.

Talks

• PyCon FR 2019 (The tool was initially developed in Python) - https://docs.google.com/presentation/d/1uVXGUpt7tC7zQ1HWegoBbEg2LHamABIqfDfiD9MWsD8/edit
• DEFCON AppSec Village 2020 "Turning offsec mindset to developer's toolset" - https://drive.google.com/file/d/15P8eSarIohwCVW-tR3FN78KJPGbpAtR1/view

License

ChopChop has been released under Apache License 2.0. Please, refer to the LICENSE file for further information.

Authors

• Paul A.
• David R. (For the Python version)
• Stanislas M. (For the Golang version)