Is ChopChop a DAST tool?

Yes. Michelin's CERT built it for dynamic application security testing. It probes running endpoints from the outside and reports exposure by signature, so it runs unauthenticated against a live web root rather than reading source code.

Can ChopChop block a CI pipeline?

Yes. Set --max-severity and the run blocks the pipeline whenever a check at or above that severity fires, which lets you fail a build on high-severity exposure before release.

How do I add my own checks?

Write them in the signature file and point --signatures at it. Each check carries a severity that ChopChop uses for --severity-filter and for the --max-severity gate.

How do I scan a list of URLs?

Pass the list to --url-file instead of a single URL. In a Trickest workflow, wire a prober like httpx into the ChopChop node so it receives only hosts that responded.

Does ChopChop detect CVEs or outdated software?

Not on its own. It checks for exposed files and services defined by its signatures, not a versioned CVE database. For CVE and outdated-software coverage, pair it with a template scanner like nuclei in the same workflow.

Can ChopChop export results as JSON?

Upstream ChopChop can write JSON and CSV through its --export-formats option, but that flag is not exposed on the Trickest node. The node writes a file and a folder of findings that you route into the rest of your triage path.

Updated Jul 14, 2026

Scanners

Scan web endpoints for exposed files, folders, and services

A command-line scanner that finds exposed services, files, and folders through the web root.

Find exposed files and services Gate a CI pipeline on severity Run signatures you wrote yourself

overview

What chopchop does

ChopChop scans a set of web endpoints and flags exposure of services, files, and folders reachable through the web root. Its checks are signatures written in a YAML config, so what it looks for stays under your control: ship the defaults, edit them, or add your own for the patterns that matter to your apps. Michelin's CERT built it for dynamic application security testing that developers can extend.

Because each signature carries a severity, ChopChop fits a CI gate. Set a maximum severity and the run blocks the pipeline when a check at or above that level fires, which turns a scanner into a release guardrail. Plugin and severity filters narrow a run to the checks you want to run.

On Trickest, ChopChop is a Scanners node that takes a file of URLs and writes a file and a folder of results. Feed it live hosts from a prober, point it at a curated signature file, and route the findings into the same triage path as the rest of your scan output.

source github.com/michelin/ChopChop

use cases

Where chopchop fits

Find exposed files and services

Run the signature set against a host to surface backups, config files, .git and .env leaks, and admin interfaces reachable through the web root.

Gate a CI pipeline on severity

Set a maximum severity so the run fails the pipeline whenever a check at or above that level fires, stopping risky exposure before release.

Run signatures you wrote yourself

Add checks to the YAML config for patterns specific to your stack, then point ChopChop at that file so it tests exactly what you define.

Scan a list of probed hosts

Pass a URL file from an httpx run so ChopChop only tests endpoints already known to respond, then filter by plugin or severity to focus the run.

reference

chopchop inputs and flags

9 inputs

Name	Type	Flag	Description
url-file	FILE	--url-file	File of URLs to test, used instead of a single URL.
signatures	FILE	--signatures	Path to the signature file (default chopchop.yml).
threads	STRING	--threads	Number of concurrent threads (default 1).
timeout	STRING	--timeout	Timeout for the HTTP requests (default 10s).
max-severity	STRING	--max-severity	Block the CI pipeline if a finding's severity is at or above this level.
severity-filter	STRING	--severity-filter	Only run checks that match the given severity.
plugin-filters	STRING	--plugin-filters	Only run the plugin whose name matches this value.
insecure	BOOLEAN	--insecure	Control SSL certificate verification for the HTTP requests.

Showing key inputs. chopchop exposes 9 inputs in total.

Full flag reference (9 inputs)

Name	Type	Flag	Description
threads	STRING	--threads	Number of threads (default 1).
timeout	STRING	--timeout	Timeout for the HTTP requests (default 10s).
insecure	BOOLEAN	--insecure	Control SSL certificate verification.
url-file	FILE	--url-file	Path to a file containing URLs to test. Use this instead of a single URL, not both together.
verbosity	STRING	-v	Log level: debug, info, warn, error, fatal, panic (default "warning").
signatures	FILE	--signatures	Path to the signature file (default "chopchop.yml").
max-severity	STRING	--max-severity	Block the CI pipeline if severity is over or equal to the specified level.
plugin-filters	STRING	--plugin-filters	Filter by plugin name; the engine only checks for the plugin with the same name.
severity-filter	STRING	--severity-filter	Filter by severity; the engine checks only for checks of the same severity.

example

Run chopchop

chopchop · command

# scan probed hosts against a signature set, gate on high severitychopchop --url-file urls.txt --signatures chopchop.yml --threads 8 --max-severity High

sample output

+---------------------+----------------+----------+----------------------+| URL                 | ENDPOINT       | SEVERITY | PLUGIN               |+---------------------+----------------+----------+----------------------+| https://example.com | /.git/config   | High     | Git config exposed   || https://example.com | /.env          | High     | Env file exposed     || https://example.com | /server-status | Medium   | Apache status page   || https://example.com | /phpinfo.php   | Medium   | PHPInfo exposed      || https://example.com | /.svn/entries  | Low      | SVN metadata exposed |+---------------------+----------------+----------+----------------------+

guidance

Choosing chopchop

Use ChopChop to check known web roots for exposed files and services with signatures you control, especially when you want a severity-based CI gate. It tests endpoints you already have, so feed it probed hosts. For broad CVE coverage, pair it with a template scanner like nuclei.

nuclei

Larger template ecosystem for CVEs and misconfigurations. ChopChop is leaner and signature-driven for web-root exposure.

nikto

Classic web server scanner. ChopChop's signatures are YAML and built to extend.

snallygaster

Hunts for secret files on web servers. Overlaps on exposure, narrower scope.

faq

chopchop questions

Exposed services, files, and folders reachable through the web root: things like backup archives, .git and .env leaks, admin panels, and status pages. Each pattern is a signature in a YAML config you can edit or replace.

Run chopchop yourself

Hosts are probed by httpx, then ChopChop scans the live ones against its signatures and writes the exposure findings as a queryable output.

Run chopchop in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url-file

FILE

--url-file

File of URLs to test, used instead of a single URL.

signatures

FILE

--signatures

Path to the signature file (default chopchop.yml).

threads

STRING

--threads

Number of concurrent threads (default 1).

timeout

STRING

--timeout

Timeout for the HTTP requests (default 10s).

max-severity

STRING

--max-severity

Block the CI pipeline if a finding's severity is at or above this level.

severity-filter

STRING

--severity-filter

Only run checks that match the given severity.

plugin-filters

STRING

--plugin-filters

Only run the plugin whose name matches this value.

insecure

BOOLEAN

--insecure

Control SSL certificate verification for the HTTP requests.

Name

Type

Flag

Description

threads

STRING

--threads

Number of threads (default 1).

timeout

STRING

--timeout

Timeout for the HTTP requests (default 10s).

insecure

BOOLEAN

--insecure

Control SSL certificate verification.

url-file

FILE

--url-file

Path to a file containing URLs to test. Use this instead of a single URL, not both together.

verbosity

STRING

-v

Log level: debug, info, warn, error, fatal, panic (default "warning").

signatures

FILE

--signatures

Path to the signature file (default "chopchop.yml").

max-severity

STRING

--max-severity

Block the CI pipeline if severity is over or equal to the specified level.

plugin-filters

STRING

--plugin-filters

Filter by plugin name; the engine only checks for the plugin with the same name.

severity-filter

STRING

--severity-filter

Filter by severity; the engine checks only for checks of the same severity.

+---------------------+----------------+----------+----------------------+| URL | ENDPOINT | SEVERITY | PLUGIN |+---------------------+----------------+----------+----------------------+| https://example.com | /.git/config | High | Git config exposed || https://example.com | /.env | High | Env file exposed || https://example.com | /server-status | Medium | Apache status page || https://example.com | /phpinfo.php | Medium | PHPInfo exposed || https://example.com | /.svn/entries | Low | SVN metadata exposed |+---------------------+----------------+----------+----------------------+

Scan web endpoints for exposed files, folders, and services

What chopchop does

Where chopchop fits

Find exposed files and services

Gate a CI pipeline on severity

Run signatures you wrote yourself

Scan a list of probed hosts

chopchop inputs and flags

Run chopchop

Choosing chopchop

nuclei

nikto

snallygaster

chopchop questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

cmseek

jaeles

Run chopchop yourself

Scan web endpoints for exposed files, folders, and services

What chopchop does

Where chopchop fits

Find exposed files and services

Gate a CI pipeline on severity

Run signatures you wrote yourself

Scan a list of probed hosts

chopchop inputs and flags

Run chopchop

Choosing chopchop

nuclei

nikto

snallygaster

chopchop questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

cmseek

jaeles

Run chopchop yourself