loading
Loading content
loading
Scanners
Signature scanner for exposed files, folders, and services on web roots.
overview
ChopChop requests paths on known web endpoints and flags exposure defined in YAML signatures. Point --signatures at the default set or your own file. Michelin CERT built it so teams can extend the checks.
Each signature carries a severity. Set --max-severity to fail a CI run when a finding meets that bar. Narrow a pass with --severity-filter or --plugin-filters, and size concurrency with --threads and --timeout.
Feed --url-file from a prober such as httpx so you only hit responding hosts. The node writes a file and a folder of findings gated by --max-severity. For CVE-style coverage, pair with nuclei rather than stretching ChopChop beyond web-root exposure.
source github.com/michelin/ChopChop
use cases
Run the signature set against a host to surface backups, config files, .git and .env leaks, and admin interfaces reachable through the web root.
Set a maximum severity so the run fails the pipeline whenever a check at or above that level fires, stopping risky exposure before release.
Add checks to the YAML config for patterns specific to your stack, then point ChopChop at that file so it tests exactly what you define.
Pass a URL file from an httpx run so ChopChop only tests endpoints already known to respond, then filter by plugin or severity to focus the run.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url-file | FILE | --url-file | File of URLs to test, used instead of a single URL. |
| signatures | FILE | --signatures | Path to the signature file (default chopchop.yml). |
| threads | STRING | --threads | Number of concurrent threads (default 1). |
| timeout | STRING | --timeout | Timeout for the HTTP requests (default 10s). |
| max-severity | STRING | --max-severity | Block the CI pipeline if a finding's severity is at or above this level. |
| severity-filter | STRING | --severity-filter | Only run checks that match the given severity. |
| plugin-filters | STRING | --plugin-filters | Only run the plugin whose name matches this value. |
| insecure | BOOLEAN | --insecure | Control SSL certificate verification for the HTTP requests. |
Showing key inputs. chopchop exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| threads | STRING | --threads | Number of threads (default 1). |
| timeout | STRING | --timeout | Timeout for the HTTP requests (default 10s). |
| insecure | BOOLEAN | --insecure | Control SSL certificate verification. |
| url-file | FILE | --url-file | Path to a file containing URLs to test. Use this instead of a single URL, not both together. |
| verbosity | STRING | -v | Log level: debug, info, warn, error, fatal, panic (default "warning"). |
| signatures | FILE | --signatures | Path to the signature file (default "chopchop.yml"). |
| max-severity | STRING | --max-severity | Block the CI pipeline if severity is over or equal to the specified level. |
| plugin-filters | STRING | --plugin-filters | Filter by plugin name; the engine only checks for the plugin with the same name. |
| severity-filter | STRING | --severity-filter | Filter by severity; the engine checks only for checks of the same severity. |
example
# scan probed hosts against a signature set, gate on high severitychopchop --url-file urls.txt --signatures chopchop.yml --threads 8 --max-severity High+---------------------+----------------+----------+----------------------+| URL | ENDPOINT | SEVERITY | PLUGIN |+---------------------+----------------+----------+----------------------+| https://example.com | /.git/config | High | Git config exposed || https://example.com | /.env | High | Env file exposed || https://example.com | /server-status | Medium | Apache status page || https://example.com | /phpinfo.php | Medium | PHPInfo exposed || https://example.com | /.svn/entries | Low | SVN metadata exposed |+---------------------+----------------+----------+----------------------+guidance
Use ChopChop when you already have live URLs and want signature checks for exposed files and services, especially with a --max-severity CI gate. For broad CVE templates, use nuclei.
Larger template ecosystem for CVEs and misconfigurations. ChopChop stays lean and signature-driven for web-root exposure.
Classic web server scanner. ChopChop signatures are YAML and built to extend.
Hunts for secret files on web servers. Overlaps on exposure with a narrower scope.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
Hosts are probed by httpx, then ChopChop scans the live ones against its signatures and writes the exposure findings as a queryable output.
Facts on this page come from the live Trickest tool library.