Windows

Windows Installation Video

Please refer to the video below for installing on an Apache web server in a Windows environment.

Windows Installation Directory Structure

C:\DeepFinder
├── bin           // Path for executables and .dll modules
│   ├── agent.exe
│   ├── iisfilter32.dll
│   ├── iisfilter64.dll
│   ├── libfilter32.dll
│   ├── libfilter64.dll 
│   ├── mod_deepfinder20.dll
│   ├── mod_deepfinder22.dll
│   ├── mod_deepfinder24.dll
│   ├── scanfile.exe
│   ├── starter.exe
│   └── updater.exe
├── certs         // Path for .pem certificates for SSL communication
│   └── deepfinder.pem
├── conf          // Path for configuration files
│   ├── config.xml
│   ├── file_md5.xml
│   └── web.xml
├── java          // Path for Java WAS integration filter
│   └── DfFilter.jar
├── log           // Path for Agent-related logs
│   └── … .log
├── policy        // Path for policy files synchronized from the Manager
│   ├── policy.db
│   └── PREIP
│       ├── 100.xml
│       └── … .xml
├── Util          // Path for other utilities
│   ├── …
│   └── …
└── uninstall.exe   // Uninstallation program

Danger

To install the DeepFinder Agent correctly, the target web server (Web Server, WAS) must be running.

Windows Web Server Agent Installation

1) Download and run the provided installation file (DeepFinder.exe).

http://download.deepfinder.co.kr/DeepFinder/1.0/DeepFinder.exe

2) When the installation screen appears, click the [Next] button to begin.

3) Review and agree to the license agreement, then click the [Next] button.

4) Enter the Agent registration information confirmed from the Manager accurately.

Item	Description
AID/AUTH KEY	Enter the AID or Authentication Key (AUTH KEY) issued by the Manager. For automatic registration, enter the Company/Domain Group's Authentication Key. For manual registration, enter the AID issued after creating the Agent.
Manager IP	Enter the IP address of the Manager server.
Manager Port	Enter the port for communication with the Manager server. (Can be found in the `myport` item of the Manager's `config.xml` file)
Protocol	Set the communication protocol between the Manager and Agent (tcp or ssl).
Type	Select the type of web server where the Agent will be installed. [ IIS ], [Apache], [ Tomcat ], [Jeus], [Resin] ※ Nginx is not supported.

Automatic Web Server Configuration

For IIS and Apache, Agent settings are applied automatically only when the respective web server process is running.
- The installation cannot proceed if the IIS service is stopped.
- If the Apache process is stopped, you must manually specify the path to the httpd.conf file.

4-1) IIS Configuration Example

4-2) Apache Configuration Example

4-2-1) When Apache process is running

4-2-2) When Apache process is not running

5) Specify the path where the Agent will be installed.

6) Specify the folder name to be created in the Start Menu.

7) To apply the web server filter immediately after installation, click [Yes].

8) Click [Finish] to complete the Agent installation.

Additional WAS Configuration

Since automatic configuration is not supported for WAS (Web Application Servers), manual configuration is required as described below.
For detailed configuration information for each WAS, please refer to the WAS Configuration Guide.

Applying the Tomcat Filter

1) Copy the Library
Copy the DfFilter.jar file from the DeepFinder installation path (C:\DeepFinder\java) to the Tomcat library path ([Tomcat DIR]\lib).

DfFilter.jar original location (C:\DeepFinder\java)

DfFilter.jar copy destination (%Tomcat Install Path%/lib)

2) Config Settings (For Tomcat 7.0.29 and earlier)

Register the DeepFinder filter in the Tomcat configuration file (web.xml).
You can copy the filter configuration content from the C:\DeepFinder\conf\web.xml file.

WAS Agent - web.xml modification path example

WAS Agent - Adding the module script to web.xml

The full web.xml script can be found at WAS Filter Script.

3) Restart WAS
Once the configuration is complete, restart the Tomcat service to apply the filter.

Tomcat Agent service restart example

Applying the Jeus Filter

1) Copy the Library
Copy the DfFilter.jar file from the DeepFinder installation path (C:\DeepFinder\java) to the JEUS library path ([JEUS_HOME]/lib/system).

DfFilter.jar original location (C:\DeepFinder\java)

DfFilter.jar copy destination (%JEUS Install Path%\lib\system)

2) Config Settings

Register the DeepFinder filter in the JEUS configuration file (webcommon.xml).
The DeepFinder filter must be added to the webcommon.xml file of every running Servlet for it to operate correctly.
You can copy the filter configuration content from the C:\DeepFinder\conf\web.xml file.

Jeus Agent - webcommon.xml modification path example

Jeus Agent - Adding the module script to webcommon.xml

The full web.xml script can be found at WAS Filter Script.

3) Restart WAS
Once the configuration is complete, restart the JEUS service to apply the filter.

Silent Script Installation

Note

Silent installation is supported only in IIS environments.

Script Options

/S* – Activate Silent mode
/serverip* – Manager server IP
/key* – AID or AUTHKEY
/protocol – tcp (default) or ssl

indicates a required item.
Example) DeepFinder.exe /S /serverip 127.0.0.1 /key {Agent_ID_or_Auth_Key} /protocol ssl

C:\Users\Administrator>cd Desktop
C:\Users\Administrator\Desktop>DeepFinder.exe /S /serverip 52.79.172.217 /key 43d5d5...
...
Installation of DeepFinder is completed.

Verifying the Windows Server Agent Installation

Check if the Agent service is running
In the Windows Services list (services.msc), verify that the DeepFinder Agent service status is 'Running'.

Check the connection to the Manager
In the Command Prompt (cmd), run the command below to check if a connection to the Manager port (default: 10012) is properly ESTABLISHED.
netstat –ano | findstr 10012

Check the Agent log
Check the contents of the log file (C:\DeepFinder\log\agent.log) in the Agent installation path for any errors.

Check the Manager GUI
In the DeepFinder Manager's [System Status] menu, verify that the Agent is connected correctly.

Verifying Module Configuration

Verifying and Restarting IIS 6 Configuration

1) Run the [Internet Information Services (IIS) Manager].

2) Select [Web Service Extensions] and verify that the DeepFinder ISAPI Filter is set to 'Allowed'.

3) In the [Web Site Properties] > [ISAPI Filters] tab, check that the DeepFinder filter has been added. The filter will operate correctly after restarting IIS.

ISAPI Filters

4) In the [Home Directory] tab, click the [Configuration] button to check the mapping settings.

5) Check if the web firewall filter mapping (dfFilter) has been registered.

6) In the Application Pools, run 'Recycle' to apply the settings.

Verifying and Restarting IIS 7, 8, 10 Configuration

1) In the [Internet Information Services (IIS) Manager], select the [Modules] feature for the server.

2) In [Configure Native Modules], verify that the DeepFinder module (e.g., iisfilter64) has been properly registered.

3) Also, check that the module is registered in the [Modules] menu of each individual website.

4) In [Application Pools], select the relevant pool and run 'Recycle' to apply the settings.

Verifying Windows Apache Configuration

1) Check the conf/httpd.conf file in the Apache installation path to ensure the DeepFinder module load statement has been added.
※ If the automatic addition failed during installation, manually add the line corresponding to your version to the httpd.conf file.

# For Apache 2.0
LoadModule deepfinder_module "C:/DeepFinder/bin/mod_deepfinder20.dll"
# For Apache 2.2
LoadModule deepfinder_module "C:/DeepFinder/bin/mod_deepfinder22.dll"
# For Apache 2.4
LoadModule deepfinder_module "C:/DeepFinder/bin/mod_deepfinder24.dll"

2) Restart the Apache service from the Windows Services list to apply the settings.

Final Log Verification

Once the installation is complete, perform a final check to ensure that detection logs are being recorded correctly in the Manager by conducting a simple test attack (e.g., ?id='or'1'='1).