AQTRONIX WebKnight is an application firewall for IIS and other web servers and is released under the GNU General Public License. More particularly it is an ISAPI filter that secures your web server by blocking certain requests. If an alert is triggered WebKnight will take over and protect the web server. It does this by scanning all requests and processing them based on filter rules, set by the administrator. These rules are not based on a database of attack signatures that require regular updates. Instead WebKnight uses security filters as buffer overflow, SQL injection, directory traversal, character encoding and other attacks. This way WebKnight can protect your server against all known and unknown attacks. Because WebKnight is an ISAPI filter it has the advantage of working closely with the web server, this way it can do more than other firewalls and intrusion detection systems, like scanning encrypted traffic.
-Top-
These are some features of WebKnight.
-Top-
-Top-
Installation in IIS with Windows Installer: (for IIS 6.0 see note below!)
Double click the file WebKnight.msi. This will launch Windows Installer and install WebKnight on the local machine. This method will install WebKnight as a global filter on the local machine. If Windows Installer is not installed on your system, you can download it directly from Microsoft:
Windows Installer 2.0 Redistributable for Windows NT 4.0 and 2000
Windows Installer 2.0 Redistributable for Windows 95, 98, and Me
Installation in IIS with scripts:
To install/uninstall WebKnight on the local or remote machine you can use the file install.vbs/uninstall.vbs from the setup folder. This method will install WebKnight as a global filter on the selected host or localhost.
Manual installation as a global filter in IIS:
Manual installation as a site filter in IIS:
If you want to import your settings from urlscan, you can do that by copying the file urlscan.ini to the WebKnight directory. Delete WebKnight.xml (or rename it) and your settings from urlscan.ini will be imported in a new WebKnight.xml file when you restart your web server. This can be useful if you experienced problems with your urlscan installation and you had to customize the settings of urlscan and want to keep using these settings. If you want to load the default settings again, you can do that by deleting the files WebKnight.xml and urlscan.ini in the directory WebKnight and a new WebKnight.xml will be made with the default settings when you restart your web server.
Installation in IIS 6.0: to run WebKnight as a global filter in IIS 6.0, you have two options:
Non-IIS: Look at the documentation of your web server (Note: only web servers with ISAPI filter support can run WebKnight).
-Top-
Very simple: I wanted to block viruses, script kiddies... and I wanted to prevent them from filling the web server log files and give them a nice legal notice or special response which crashes their script kiddie tool. I also wanted to be able to see all attempts without having to read all the web server log files. A possible solution was intrusion detection. However, this does not stop them, it only warns you, by analysing all the packets that passes your system. This has a second disadvantage because it cannot analyse packets sent over SSL (because it is encrypted of course). So I needed a tool which worked closely with IIS and could block certain requests even over SSL. One such tool was URLScan (free tool from Microsoft). However, I wanted to add functionality (the moment I started coding this tool, MS were at version 2.5 of urlscan) and I wanted to be able to block new attacks before the vendor has released a patch. So I started coding my own "urlscan". Today I can say I have an application that does what urlscan does and so much more...
-Top-
I know the feeling of wanting to add some functionality of some program and not being able to. With a security application like this, it is irresponsible not to make it open source. This way I know others will review the code, hacking the source, making the final product very secure. This is at least what I want to see happening. In fact this program is more than open source: it is free! You have the permission to change it, port it, do whatever you like with it on the condition that you agree with the terms of the GNU General Public License. This license gives you the freedom but also asks to respect and give the same freedom to others!
-Top-
If you want to get involved, no problem :) There's plenty of work to do. We need testing, writing customized xml files or if you're a programmer, we have the list of wanted features or you can help finishing the current work (you can search the source code for "TO DO" and you will find everything that needs to be done. A "to do"-list is also present in the file WebKnight.cpp
-Top-
Website: http://www.aqtronix.com/webknight
E-mail: parcifal@aqtronix.com
-Top-
AQTRONIX WebKnight - ISAPI Filter for securing web servers Copyright 2003 Parcifal Aertssen This file is part of AQTRONIX WebKnight. AQTRONIX WebKnight is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. AQTRONIX WebKnight is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with AQTRONIX WebKnight; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-Top-