Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-oke-v150-5-4-1La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Affichage de SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basé sur la classification professionnelle SOC
| name | cis-oke-v150-5.4.1 |
| description | Restrict Access to the Control Plane Endpoint (Automated) |
| category | cis-oke |
| version | 1.5.0 |
| author | cyberstrike-official |
| tags | ["cis","oke","kubernetes","oci","managed-services","cluster-networking","network-policy"] |
| cis_id | 5.4.1 |
| cis_benchmark | CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v1.5.0 |
| tech_stack | ["kubernetes","oci","oke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Enable Master Authorized Networks to restrict access to the cluster's control plane (master endpoint) to only an allowlist (whitelist) of authorized IPs.
Authorized networks are a way of specifying a restricted range of IP addresses that are permitted to access your cluster's control plane. Kubernetes Engine uses both Transport Layer Security (TLS) and authentication to provide secure access to your cluster's control plane from the public internet. This provides you the flexibility to administer your cluster from anywhere; however, you might want to further restrict access to a set of IP addresses that you control. You can set this restriction by specifying an authorized network.
Restricting access to an authorized network can provide additional security benefits for your container cluster, including:
When implementing Master Authorized Networks, be careful to ensure all desired networks are on the allowlist (whitelist) to prevent inadvertently blocking external access to your cluster's control plane.
Check for the following:
export OKE_CLUSTERID=<oke cluster id>
oci ce cluster get --cluster-id $OKE_CLUSTERID
Check for endpoint URL of the Kubernetes API Server in output.
Configure Master Authorized Networks for the cluster to restrict access to approved IP ranges.
By default, Master Authorized Networks is disabled.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 9.3 Maintain and Enforce Network-Based URL Filters - Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets. | x | x | |
| v7 | 7.5 Subscribe to URL-Categorization service - Subscribe to URL categorization services to ensure that they are up-to-date with the most recent website category definitions available. Uncategorized sites shall be blocked by default. | x | x |
Level 1 - OKE