用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-nginx-v300-2-4-2命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-nginx-v300-2-4-2 |
| description | Ensure requests for unknown host names are rejected (Manual) |
| category | cis-nginx |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["cis","nginx","web-server","reverse-proxy","network-configuration","basic-configuration"] |
| cis_id | 2.4.2 |
| cis_benchmark | CIS NGINX Benchmark v3.0.0 |
| tech_stack | ["nginx","linux","web-server"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
NGINX routes incoming requests to the appropriate virtual host by matching the Host header (HTTP/1.1) or :authority pseudo-header (HTTP/2, HTTP/3) against the server_name directives. If no explicit match is found, NGINX falls back to the first defined server block or the one marked as default_server. Without a properly configured catch-all block that rejects unknown hostnames, your server will respond to arbitrary domain names that happen to point to your IP address, potentially exposing internal applications or enabling Host Header attacks.
When NGINX receives a request, it selects the virtual host based on the Host header (or :authority in HTTP/2/3). If requests for unknown host names are not explicitly rejected, your applications may be served for arbitrary domains that simply point to your IP. This behavior can be abused in Host Header attacks and makes it harder to distinguish legitimate traffic from automated scans or misrouted requests in your logs.
Clients accessing the server directly via IP address or an unconfigured CNAME will be rejected. This is intended behavior but requires that all valid domains are explicitly defined in their own server blocks.
1. Review Configuration:
Check for the existence of a default server block that handles unknown hosts.
nginx -T 2>/dev/null | grep -Ei "listen.*default_server|ssl_reject_handshake"
Evaluation:
server block exists with listen ... default_server.return 444; (closes connection) or a 4xx error code.ssl_reject_handshake on; is used to prevent certificate leakage.2. Functional Test:
Send a request with an invalid Host header and verify the connection is rejected or returns an error.
# Test HTTPS (expect connection reset or 4xx)
curl -k -v https://127.0.0.1 -H
Configure a "Catch-All" default server block as the first block in your configuration (or explicitly marked with default_server).
Configuration Example (Modern Standard with TLS/HTTP3):
server {
# Listen on standard ports for IPv4 and IPv6
listen 80 default_server;
listen [::]:80 default_server;
# Listen for HTTPS (TCP) and QUIC (UDP)
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
listen 443 quic default_server;
listen [::]:443 quic default_server;
# Reject SSL Handshake for unknown domains (Prevents cert leakage)
ssl_reject_handshake on;
# Catch-all name
server_name _;
# Close connection without response (Non-standard code 444)
return 444;
}
After adding this block, ensure all your valid applications have their own server blocks with explicit server_name directives.
By default, if no default_server is defined, NGINX uses the first server block configuration it finds, potentially serving your application for any incoming request regardless of the Host header.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.1 Establish and Maintain a Secure Configuration Process | Y | Y | Y |
| v7 | 5.1 Establish Secure Configurations | Y | Y | Y |
| Tactic | Technique |
|---|---|
| Initial Access | T1190 - Exploit Public-Facing Application |
| Reconnaissance | T1595 - Active Scanning |