ChopChop: CLI tool for dynamic application security testing on web applications
ChopChop
ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.
Its goal is to scan several endpoints and identify the exposition of services/files/folders through the webroot. Checks/Signatures are declared in a config file (by default: chopchop.yml), fully configurable, and especially by developers.
Install
git clone https://github.com/michelin/ChopChop
cd ChopChop
go mod install
go build .
Use
$ ./gochopchop scan --url https://foobar.com
You can find the available flags here :
| Flag | Full flag | Description |
|---|---|---|
-h |
--help |
Help wizard |
-u |
--url |
Set the target URL |
-i |
--insecure |
Disable SSL Verification |
-c |
--config-file |
Set a custom configuration file |
-f |
--url-file |
Set a file containing a list of URLs |
--csv |
Export results in CSV | |
--json |
Export results in JSON |
Advanced usage
Here is a list of advanced usage that you might be interested in. Note: Redirectors like > for post-processing can be used.
- Ability to scan and disable SSL verification
$ ./gochopchop scan --url https://foobar.com --insecure
- Ability to scan with a custom configuration file (including custom plugins)
$ ./gochopchop scan --url https://foobar.com --insecure --config-file test_config.yml
- Ability to list all the plugins or by severity: plugins or plugins –severity High
$ ./gochopchop plugins --severity High
- Ability to block the CI pipeline by severity level (equal or over specified severity) : –block Medium
$ ./gochopchop scan --url https://foobar.com --insecure --block Medium
- Ability to list all the plugins
$ ./gochopchop plugins
- List High severity plugins
$ ./gochopchop plugins --severity High
- Set a list or URLs located in a file
$ ./gochopchop scan --url-file url_file.txt
- Export GoChopChop results in CSV and JSON format
$ ./gochopchop scan --url https://foobar.com --json --csv
Tutorial
Copyright [2020] [Manufacture Française des Pneumatiques Michelin]
