Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-tomcat10-v110-10-6The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
Based on SOC occupation classification
| name | cis-tomcat10-v110-10.6 |
| description | Enable strict servlet Compliance (Manual) |
| category | cis-tomcat |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","tomcat","linux","java","configuration","hardening","security"] |
| cis_id | 10.6 |
| cis_benchmark | CIS Apache Tomcat 10 Benchmark v1.1.0 |
| tech_stack | ["linux","tomcat","java"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The STRICT_SERVLET_COMPLIANCE influences Tomcat's behavior in several subtle ways. See the References below for the complete list. It is recommended that STRICT_SERVLET_COMPLIANCE be set to true.
When STRICT_SERVLET_COMPLIANCE is set to true, Tomcat will always send an HTTP Content-type header when responding to requests. This is significant as the behavior of web browsers is inconsistent in the absence of the Content-type header. Some browsers will attempt to determine the appropriate content-type by sniffing
Changing this to true will change a number of other default values which is likely to break the majority of systems as some browsers are unable to correctly handle the cookie headers that result from a strict adherence to the specifications. Please refer to the referenced documentation for a complete list of changed values. Defaults, regardless of whether or not they have been changed by setting org.apache.catalina.STRICT_SERVLET_COMPLIANCE can always be overridden by explicitly setting the appropriate system property or element attribute.
Ensure the -Dorg.apache.catalina.STRICT_SERVLET_COMPLIANCE=true parameter is added to the startup script which by default is located at $CATALINA_HOME/bin/catalina.sh.
Start Tomcat with strict compliance enabled, add -Dorg.apache.catalina.STRICT_SERVLET_COMPLIANCE=true to your startup script.
The default value is false.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 13.10 Perform Application Layer Filtering Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway. | ● | ||
| v7 | 5.1 Establish Secure Configurations Maintain documented, standard security configuration standards for all authorized operating systems and software. | ● | ● | ● |
Level 2
