Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-nginx-v300-2-4-2El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-nginx-v300-2-4-2 |
| description | Ensure requests for unknown host names are rejected (Manual) |
| category | cis-nginx |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["cis","nginx","web-server","reverse-proxy","network-configuration","basic-configuration"] |
| cis_id | 2.4.2 |
| cis_benchmark | CIS NGINX Benchmark v3.0.0 |
| tech_stack | ["nginx","linux","web-server"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
NGINX routes incoming requests to the appropriate virtual host by matching the Host header (HTTP/1.1) or :authority pseudo-header (HTTP/2, HTTP/3) against the server_name directives. If no explicit match is found, NGINX falls back to the first defined server block or the one marked as default_server. Without a properly configured catch-all block that rejects unknown hostnames, your server will respond to arbitrary domain names that happen to point to your IP address, potentially exposing internal applications or enabling Host Header attacks.
When NGINX receives a request, it selects the virtual host based on the Host header (or :authority in HTTP/2/3). If requests for unknown host names are not explicitly rejected, your applications may be served for arbitrary domains that simply point to your IP. This behavior can be abused in Host Header attacks and makes it harder to distinguish legitimate traffic from automated scans or misrouted requests in your logs.
Clients accessing the server directly via IP address or an unconfigured CNAME will be rejected. This is intended behavior but requires that all valid domains are explicitly defined in their own server blocks.
1. Review Configuration:
Check for the existence of a default server block that handles unknown hosts.
nginx -T 2>/dev/null | grep -Ei "listen.*default_server|ssl_reject_handshake"
Evaluation:
server block exists with listen ... default_server.return 444; (closes connection) or a 4xx error code.ssl_reject_handshake on; is used to prevent certificate leakage.2. Functional Test:
Send a request with an invalid Host header and verify the connection is rejected or returns an error.
# Test HTTPS (expect connection reset or 4xx)
curl -k -v https://127.0.0.1 -H
Configure a "Catch-All" default server block as the first block in your configuration (or explicitly marked with default_server).
Configuration Example (Modern Standard with TLS/HTTP3):
server {
# Listen on standard ports for IPv4 and IPv6
listen 80 default_server;
listen [::]:80 default_server;
# Listen for HTTPS (TCP) and QUIC (UDP)
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
listen 443 quic default_server;
listen [::]:443 quic default_server;
# Reject SSL Handshake for unknown domains (Prevents cert leakage)
ssl_reject_handshake on;
# Catch-all name
server_name _;
# Close connection without response (Non-standard code 444)
return 444;
}
After adding this block, ensure all your valid applications have their own server blocks with explicit server_name directives.
By default, if no default_server is defined, NGINX uses the first server block configuration it finds, potentially serving your application for any incoming request regardless of the Host header.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.1 Establish and Maintain a Secure Configuration Process | Y | Y | Y |
| v7 | 5.1 Establish Secure Configurations | Y | Y | Y |
| Tactic | Technique |
|---|---|
| Initial Access | T1190 - Exploit Public-Facing Application |
| Reconnaissance | T1595 - Active Scanning |