{"id":20905,"date":"2021-12-24T14:44:00","date_gmt":"2021-12-24T14:44:00","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=20905"},"modified":"2021-12-22T19:33:31","modified_gmt":"2021-12-22T19:33:31","slug":"chopchop","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/chopchop\/","title":{"rendered":"ChopChop : ChopChop Is A CLI To Help Developers Scanning Endpoints And Identifying Exposition Of Sensitive Services\/Files\/Folders"},"content":{"rendered":"\n

ChopChop<\/strong> is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT.<\/p>\n\n\n\n

Its goal is to scan several endpoints and identify exposition of services\/files\/folders through the webroot. Checks\/Signatures are declared in a config file (by default: chopchop.yml<\/strong><\/code>), fully configurable, and especially by developers.<\/p>\n\n\n\n

Building<\/strong><\/p>\n\n\n\n

We tried to make the build process painless and hopefully, it should be as easy as:<\/p>\n\n\n\n

$ go mod download
$ go build .<\/strong><\/p>\n\n\n\n

There should be a resulting gochopchop<\/strong><\/code> binary in the folder.<\/p>\n\n\n\n

<\/a>Using Docke<\/strong>r<\/p>\n\n\n\n

Thanks to Github Container Registry, we are able to provide you some freshly-build Docker images!<\/p>\n\n\n\n

docker run ghcr.io\/michelin\/gochopchop scan https:\/\/<\/strong>foobar.com -v debug<\/p>\n\n\n\n

But if you prefer, you can also build it locally, see below:<\/p>\n\n\n\n

<\/a>Build locally<\/strong><\/p>\n\n\n\n

docker build -t gochopc<\/strong>hop .<\/p>\n\n\n\n

Usage<\/strong><\/p>\n\n\n\n

We are continuously trying to make goChopChop<\/strong><\/code> as easy as possible. Scanning a host with this utility is as simple as :<\/p>\n\n\n\n

$ .\/gochopchop scan https:\/\/foobar.co<\/strong>m<\/p>\n\n\n\n

Using Docker<\/strong><\/p>\n\n\n\n

docker run gochopchop scan https:\/\/foobar.com<\/strong><\/p>\n\n\n\n

Custom configuration file<\/strong><\/p>\n\n\n\n

docker run -v .\/:\/app chopchop scan -c \/app\/chopchop.yml h<\/strong>ttps:\/\/foobar.com<\/p>\n\n\n\n

What’s next<\/strong><\/p>\n\n\n\n

The Golang rewrite took place a couple of months ago but there’s so much to do, still. Here are some features we are planning to integrate : [x] Threading for better performance [x] Ability to specify the number of concurrent threads [x] Colors and better formatting [x] Ability to filter checks\/signatures to search for [x] Mock and unit tests [x] Github CI And much more!<\/p>\n\n\n\n

<\/a>Testing<\/strong><\/p>\n\n\n\n

To quickly end-to-end test chopchop, we provided a web-server in tests\/server.go<\/strong><\/code>. To try it, please run go run<\/strong> tests\/server.go<\/strong><\/code> then run chopchop with the following command .\/gochopchop scan http:\/\/localhost:8000 --verbosity Debug<\/strong><\/code>. ChopChop should print “no vulnerabilities found”.<\/p>\n\n\n\n

There are also unit test that you can launch with go test -v .\/...<\/strong><\/code>. These tests are integrated in the github CI workflow.<\/p>\n\n\n\n

<\/a>Available Flags<\/strong><\/p>\n\n\n\n

You can find the available flags available for the scan<\/code> command :<\/p>\n\n\n\n

Flag<\/th>Full flag<\/th>Description<\/th><\/tr><\/thead>
-h<\/strong><\/code><\/td>--help<\/strong><\/code><\/td>Help wizard<\/td><\/tr>
-v<\/strong><\/code><\/td>--verbosity<\/strong><\/code><\/td>Verbose level of logging<\/td><\/tr>
-c<\/strong><\/code><\/td>--signature<\/strong><\/code><\/td>Path of custom signature file<\/td><\/tr>
-k<\/strong><\/code><\/td>--insecure<\/strong><\/code><\/td>Disable SSL Verification<\/td><\/tr>
-u<\/strong><\/code><\/td>--url-file<\/strong><\/code><\/td>Path to a specified file containing urls to test<\/td><\/tr>
-b<\/strong><\/code><\/td>--max-severity<\/strong><\/code><\/td>Block the CI pipeline if severity is over or equal specified flag<\/td><\/tr>
-e<\/strong><\/code><\/td>--export<\/strong><\/code><\/td>Export type of the output (csv and\/or json)<\/td><\/tr>
<\/td>--export-filename<\/strong><\/code><\/td>Specify the filename for the export file(s)<\/td><\/tr>
-t<\/strong><\/code><\/td>--timeout<\/strong><\/code><\/td>Timeout for the HTTP requests<\/td><\/tr>
<\/td>--severity-filter<\/strong><\/code><\/td>Filter Plugins by severity<\/td><\/tr>
<\/td>--plugin-filter<\/strong><\/code><\/td>Filter Plugins by name of plugin<\/td><\/tr>
<\/td>--threads<\/strong><\/code><\/td>Number of concurrent threads<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/a>Advanced usage<\/strong><\/p>\n\n\n\n

Here is a list of advanced usage that you might be interested in. Note: Redirectors like ><\/code> for post processing can be used.<\/p>\n\n\n\n