Scanners
Scan live web roots for exposed files
Signature scanner for exposed files, folders, and services on web roots.
overview
What chopchop does
ChopChop requests paths on known web endpoints and flags exposure defined in YAML signatures. Point --signatures at the default set or your own file. Michelin CERT built it so teams can extend the checks.
Each signature carries a severity. Set --max-severity to fail a CI run when a finding meets that bar. Narrow a pass with --severity-filter or --plugin-filters, and size concurrency with --threads and --timeout.
Feed --url-file from a prober such as httpx so you only hit responding hosts. The node writes a file and a folder of findings gated by --max-severity. For CVE-style coverage, pair with nuclei rather than stretching ChopChop beyond web-root exposure.
source github.com/michelin/ChopChop
use cases
Where chopchop fits
Find exposed files and services
Run the signature set against a host to surface backups, config files, .git and .env leaks, and admin interfaces reachable through the web root.
Gate a CI pipeline on severity
Set a maximum severity so the run fails the pipeline whenever a check at or above that level fires, stopping risky exposure before release.
Run signatures you wrote yourself
Add checks to the YAML config for patterns specific to your stack, then point ChopChop at that file so it tests exactly what you define.
Scan a list of probed hosts
Pass a URL file from an httpx run so ChopChop only tests endpoints already known to respond, then filter by plugin or severity to focus the run.
reference
chopchop inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url-file | FILE | --url-file | File of URLs to test, used instead of a single URL. |
| signatures | FILE | --signatures | Path to the signature file (default chopchop.yml). |
| threads | STRING | --threads | Number of concurrent threads (default 1). |
| timeout | STRING | --timeout | Timeout for the HTTP requests (default 10s). |
| max-severity | STRING | --max-severity | Block the CI pipeline if a finding's severity is at or above this level. |
| severity-filter | STRING | --severity-filter | Only run checks that match the given severity. |
| plugin-filters | STRING | --plugin-filters | Only run the plugin whose name matches this value. |
| insecure | BOOLEAN | --insecure | Control SSL certificate verification for the HTTP requests. |
Showing key inputs. chopchop exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| threads | STRING | --threads | Number of threads (default 1). |
| timeout | STRING | --timeout | Timeout for the HTTP requests (default 10s). |
| insecure | BOOLEAN | --insecure | Control SSL certificate verification. |
| url-file | FILE | --url-file | Path to a file containing URLs to test. Use this instead of a single URL, not both together. |
| verbosity | STRING | -v | Log level: debug, info, warn, error, fatal, panic (default "warning"). |
| signatures | FILE | --signatures | Path to the signature file (default "chopchop.yml"). |
| max-severity | STRING | --max-severity | Block the CI pipeline if severity is over or equal to the specified level. |
| plugin-filters | STRING | --plugin-filters | Filter by plugin name; the engine only checks for the plugin with the same name. |
| severity-filter | STRING | --severity-filter | Filter by severity; the engine checks only for checks of the same severity. |
example
Run chopchop
# scan probed hosts against a signature set, gate on high severitychopchop --url-file urls.txt --signatures chopchop.yml --threads 8 --max-severity High+---------------------+----------------+----------+----------------------+| URL | ENDPOINT | SEVERITY | PLUGIN |+---------------------+----------------+----------+----------------------+| https://example.com | /.git/config | High | Git config exposed || https://example.com | /.env | High | Env file exposed || https://example.com | /server-status | Medium | Apache status page || https://example.com | /phpinfo.php | Medium | PHPInfo exposed || https://example.com | /.svn/entries | Low | SVN metadata exposed |+---------------------+----------------+----------+----------------------+guidance
Choosing chopchop
Use ChopChop when you already have live URLs and want signature checks for exposed files and services, especially with a --max-severity CI gate. For broad CVE templates, use nuclei.
nuclei
Larger template ecosystem for CVEs and misconfigurations. ChopChop stays lean and signature-driven for web-root exposure.
nikto
Classic web server scanner. ChopChop signatures are YAML and built to extend.
snallygaster
Hunts for secret files on web servers. Overlaps on exposure with a narrower scope.
faq
chopchop questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run chopchop yourself
Hosts are probed by httpx, then ChopChop scans the live ones against its signatures and writes the exposure findings as a queryable output.
Facts on this page come from the live Trickest tool library.