PHP Malware Analysis
wso.php
md5: b1df4e10417d0bcf2e15ce7bfcf2c932
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Title
- Search (HTML)
URLs
- http://en.wikipedia.org/wiki/Domain_name_system (HTML)
- http://localhost/wso.php (HTML)
- http://searchguide.level3.com/search/?q= (Deobfuscated, Original)
- http://searchguide.level3.com/search/?q=http://repository.codehaus.org/org/apache/struts/struts2-plugins/wp-content/uploads/wso.php&t=0 (Deobfuscated, Original)
- https://apim.docs.wso2.com/en/latest/get-started/api-manager-quick-start-guide/ (HTML)
- https://apim.docs.wso2.com/en/latest/install-and-setup/setup/deployment-best-practices/changing-the-hostname/ (HTML)
- https://docs.wso2.com/display/IS510/How+To:+Login+to+WSO2+Products+via+Identity+Server (HTML)
- https://docs.wso2.com/display/IS530/Configuring+Single+Sign-On (HTML)
- https://github.com/tennc/webshell/blob/master/php/wso/wso.php (HTML)
- https://is.docs.wso2.com/en/5.9.0/setup/http-access-logging/ (HTML)
- https://stackoverflow.com/questions/10834673/localhost-used-as-common-name-in-the-default-wso2-certificate-creates-no-subje (HTML)
- https://support.mediacomcable.com/#!/About/Contact (HTML)
- https://www.centurylink.com/aboutus/legal/privacy-policy.html (HTML)
- https://yasasramanayaka.medium.com/running-oidc-conformance-suite-locally-with-wso2-identity-server-b8947a0bb63f (HTML)
- www.yahoo.com (HTML)
Deobfuscated PHP code
<html><head><meta http-equiv="refresh" content="0;url=http://searchguide.level3.com/search/?q=http://repository.codehaus.org/org/apache/struts/struts2-plugins/wp-content/uploads/wso.php&t=0"/></head><body><script>window.location="http://searchguide.level3.com/search/?q="+escape(window.location)+"&r="+escape(document.referrer)+"&t=0";</script></body></html>Execution traces
data/traces/b1df4e10417d0bcf2e15ce7bfcf2c932_trace-1676239096.5907.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 19:58:42.488593]
1 0 1 0.000282 393512
1 3 0 0.000340 393416 {main} 1 /var/www/html/uploads/wso.php 0 0
1 3 1 0.000363 393416
0.000399 314224
TRACE END [2023-02-12 19:58:42.488761]
Generated HTML code
<html lang="en"><head>
<title>Search</title>
<link href="/s/css/bootstrap.min.css" rel="stylesheet">
<link href="/s/css/searchguide.css" rel="stylesheet">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="apple-touch-icon-precomposed" sizes="144x144" href="/s/ico/apple-touch-icon-144-precomposed.png">
<link rel="apple-touch-icon-precomposed" sizes="114x114" href="/s/ico/apple-touch-icon-114-precomposed.png">
<link rel="apple-touch-icon-precomposed" sizes="72x72" href="/s/ico/apple-touch-icon-72-precomposed.png">
<link rel="apple-touch-icon-precomposed" href="/s/ico/apple-touch-icon-57-precomposed.png">
<link rel="shortcut icon" href="/s/img/lvl3/favicon.ico">
<!--[if lt IE 9]>
<link href="/s/css/searchguide-ie-compat.css" rel="stylesheet">
<![endif]-->
</head>
<body>
<div class="header container-fluid">
<div class="search-bar row">
<div class="col-xs-12 col-sm-1 col-md-1 col-lg-1 search-bar-logo">
<img class="logo img-responsive" src="/s/img/lvl3/logo.png">
</div>
<div class="col-xs-12 col-sm-6 col-md-5 col-lg-5 search-bar-bar">
<form action="/search/" method="get">
<div class="input-group">
<input class="form-control" name="q" type="search" placeholder="Localhost Wso" x-webkit-speech="">
<div class="input-group-btn">
<button class="btn btn-primary btn-lg search-btn" type="submit">
<span class="glyphicon glyphicon-search"></span>
</button>
</div>
</div>
<input type="hidden" name="t" value="9">
</form>
</div>
<div class="col-xs-12 col-sm-3 col-md-2 col-lg-2 hidden-xs search-bar-filter" data-toggle="tooltip" data-original-title="Search Filter has not been enabled <br> Adult and other potentially offensive material will not be filtered.">
<button class="btn btn-info pull-right adult-search" type="button">
<span class="adult-search-text">Filter Off</span>
<span class="glyphicon glyphicon-ok-sign icon-white"></span>
</button>
</div>
</div>
<div class="row search-options-row">
<div class="col-xs-12 col-sm-12 col-md-10 col-md-offset-1 col-lg-10 col-lg-offset-1">
<ul class="list-inline search-options pull-right">
<li class="search-option"><a href="#pref-modal" data-toggle="modal">Settings</a></li>
<li class="search-option-extra search-option"><a href="#faq-modal" data-toggle="modal">F.A.Q.</a></li>
<div class="btn-group hidden-sm hidden-md hidden-lg search-option-more hidden-ie8">
<button type="button" class="btn btn-default dropdown-toggle" data-toggle="dropdown">
More...
<span class="caret"></span>
</button>
<ul class="dropdown-menu">
<li class="search-option"><a href="#faq-modal" data-toggle="modal">F.A.Q.</a></li>
</ul>
</div>
</ul>
<ul class="list-inline search-options">
<li class="search-option search-option-selected"><a href="/search/?q=Localhost%20Wso">Web</a></li>
</ul>
</div>
</div>
</div>
<div class="container-fluid">
<div class="row">
<div class="col-xs-12 col-sm-12 col-md-12 col-lg-5 col-lg-offset-1 serp-notification">
<div class="alert alert-info alert-dismissable">
<button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button>
<i class="icon-info-sign icon-white"></i> The Search Guide Service has been enabled to provide helpful searches from web address errors. You entered an unknown name that the service used to present site suggestions which you may find useful. Clicking any of these suggestions provides you with Yahoo! search results, which may include relevant sponsored links.
</div>
</div>
</div>
<div class="row">
<div class="col-xs-12 col-sm-12 col-md-6 col-md-offset-1 col-lg-5 col-lg-offset-1">
<div class="search-results">
<h5>Did you mean “http://localhost/wso.php”? Search Results for “Localhost Wso”</h5>
<div class="links">
<div class="link">
<a href="https://stackoverflow.com/questions/10834673/localhost-used-as-common-name-in-the-default-wso2-certificate-creates-no-subje" s="false" h="stackoverflow.com/questions/10834673">
<div class="link-title">'<b>Localhost</b>' used as Common name in the default WSo2 certificate creates ...</div>
<div class="link-host">stackoverflow.com/questions/10834673</div>
<div class="link-text">'<b>Localhost</b>' used as Common name in the default WSo2 certificate creates No Subject Alternative Name found Ask Question Asked 10 years, 8 months ago Modified 8 years, 3 months ago Viewed 3k times Part of WSO2 Collective 4 We have used wso2 esb (version 4.0.3) for exposing our webservice.</div>
</a>
</div>
<div class="link">
<a href="https://docs.wso2.com/display/IS510/How+To:+Login+to+WSO2+Products+via+Identity+Server" s="false" h="docs.wso2.com/display/IS510/How+To:+Login+to+WSO2+Products...">
<div class="link-title">How To: Login to WSO2 Products via Identity Server</div>
<div class="link-host">docs.wso2.com/display/IS510/How+To:+Login+to+WSO2+Products...</div>
<div class="link-text">Download the WSO2 Identity Server from here. Extract the .zip file. Open a terminal and navigate to the <IS_HOME>/bin folder. Start the Identity Server using the wso2server.sh file in Unix or wso2server.bat file in Windows. Once the server is started, visit the following URL: https://<b>localhost</b>:9443/carbon/ Sign in to the WSO2 Identity Server.</div>
</a>
</div>
<div class="link">
<a href="https://yasasramanayaka.medium.com/running-oidc-conformance-suite-locally-with-wso2-identity-server-b8947a0bb63f" s="false" h="yasasramanayaka.medium.com/running-oidc-conformance-suite...">
<div class="link-title">Running OIDC Conformance Suite Locally with WSO2 Identity Server</div>
<div class="link-host">yasasramanayaka.medium.com/running-oidc-conformance-suite...</div>
<div class="link-text">OpenID foundation developed the OIDC conformance suite which can be used to test OpenID providers(OP) and relying parties(RP) for compliance against OIDC specifications. This blog will guide you through the process of configuring OIDC conformance suite to run locally with wso2 identity server on a Linux host machine.</div>
</a>
</div>
<div class="link">
<a href="https://is.docs.wso2.com/en/5.9.0/setup/http-access-logging/" s="false" h="is.docs.wso2.com/en/5.9.0/setup/http-access-logging">
<div class="link-title">HTTP Access Logging - WSO2 Identity Server Documentation</div>
<div class="link-host">is.docs.wso2.com/en/5.9.0/setup/http-access-logging</div>
<div class="link-text">Logging in to Office365 Using WSO2 Identity Server Logging in to Office365 Using WSO2 Identity Server Configuring Office365 SAML2 with WSO2 Identity Server Configuring Office365 SAML2 with WSO2 Identity Server for Multiple Domains Configuring Office365 WS-Federation with WSO2 IS Configuring On Demand Provisioning with Azure AD</div>
</a>
</div>
<div class="link">
<a href="https://github.com/tennc/webshell/blob/master/php/wso/wso.php" s="false" h="github.com/tennc/webshell/blob/master/php/wso/wso.php">
<div class="link-title">webshell/<b>wso</b>.php at master · tennc/webshell · GitHub</div>
<div class="link-host">github.com/tennc/webshell/blob/master/php/wso/wso.php</div>
<div class="link-text">webshell/<b>wso</b>.php at master · tennc/webshell · GitHub tennc / webshell Public master webshell/php/<b>wso</b>/<b>wso</b>.php Go to file Cannot retrieve contributors at this time 1469 lines (1460 sloc) 61.6 KB Raw Blame <?php /* <b>WSO</b> 2.2.0 (Web Shell by HARD _LINUX) */ $auth_pass = " 21232f297a57a5a743894a0e4a801fc3 "; //admin $color = " #fff ";</div>
</a>
</div>
<div class="link">
<a href="https://apim.docs.wso2.com/en/latest/install-and-setup/setup/deployment-best-practices/changing-the-hostname/" s="false" h="apim.docs.wso2.com/en/latest/install-and-setup/setup/...">
<div class="link-title">Change the Hostname - WSO2 API Manager Documentation 4.1.0</div>
<div class="link-host">apim.docs.wso2.com/en/latest/install-and-setup/setup/...</div>
<div class="link-text">Changing the Hostname¶. By default, WSO2 products identify the hostname of the current machine through the Java API. However, it is recommended to configure the hostname by setting the hostname parameter in the deployment.toml file of each runtime (API-M or Micro Integrator).</div>
</a>
</div>
<div class="link">
<a href="https://docs.wso2.com/display/IS530/Configuring+Single+Sign-On" s="false" h="docs.wso2.com/display/IS530/Configuring+Single+Sign-On">
<div class="link-title">Configuring Single Sign-On - Identity Server 5.3.0 - WSO2</div>
<div class="link-host">docs.wso2.com/display/IS530/Configuring+Single+Sign-On</div>
<div class="link-text">SAML2.IdPEntityId=<b>localhost</b>: The unique identifier for this SAML 2.0 Service Provider application. Note: If you are updating the value, make sure to define the same value for the Identity Provider Entity Id of the Resident IdP. Follow the steps given below: Sign in to the management console. Click Resident under Identity Providers.</div>
</a>
</div>
<div class="link">
<a href="https://apim.docs.wso2.com/en/latest/get-started/api-manager-quick-start-guide/" s="false" h="apim.docs.wso2.com/en/latest/get-started/api-manager-quick...">
<div class="link-title">API Management - WSO2 API Manager Documentation 4.1.0</div>
<div class="link-host">apim.docs.wso2.com/en/latest/get-started/api-manager-quick...</div>
<div class="link-text">In the following command it is assumed that WSO2 API-M is run locally (<b>localhost</b>) using the default ports. For more information on adding environments using different flag combinations, see Add an environment.</div>
</a>
</div>
</div>
<div class="pagination">
<a class="page-button" href="/search/?q=http%3A%2F%2Flocalhost%2Fwso.php&r=&t=0&qs=qsx-352acdf83b1b984a79856389cbf324f3bc3779ff7856d2f3c6650ebe5bf5cd574a0d0401a29d82d44afc8527c5cbe47d46ce6b20a25aab4c69ee59b4246962d54dbfc9cd8a940adca94b19a9b2b82c6cb633d5d64af09547ab70839b7929c01de9dca32d24164fc6042a88741dbde55d59b36eb9e64bc5f6b3073564c7378120b203169c228ac706e35542442cd0af7f7a829f8f53d23dfbfce0719906079f40e615959920ff495d58eeb211145433e317fbd8469d8e6df058f8e1015ec30cf857860009452d56ac8315e7e22b24f60b5a4ee8cea69c83862a2b5a9511e718f01e7d14f03b0ba09a31aaf8d1f5a822c59308cdf3a570165314276f830d28a3e509300f2cd652f133eb8cd08d262d517839b5d05648d870bf938d60a7dbe6afd4863e56b41270687b84e79e8e804e004e068b5eb9bfc3be722cb18784c2631a6c79f65f4ea9cfdce2e67f3f6f7445f9fc2b8b3801125c37e61cb64dc79d538be69feb414fdfe8b3046cd4c821c4ce082b15e25136c30272e5b866023ef4b8fa31a7e5440db3022b152b3c574cf06ffd9fbd236e1a35f73a8b1767141fc2a88db097c32d3b814852ab94c1ea1a0a42c7cd5446725ccb17f2a940e2786700f0375a50588e59820602c763fea25d62eeae72033d356f8a8d00f6e22c05aa9aef77e88034bc8194eee205d8c46f96520867eeec43387b5395171a4a140f4dbd74d51efa9e3df7fcb28e82c8cabbefc6197f3c92bcddc2fe5fbf546bb9f3d02ffc1cb2a39f6e4fe2fd7cf44f54efafd230666de3d7defe4a943b3634437901d73b74e51aa24bff4050d5ece7d076372efb808bf93f3ada5c0841219cb724da3b35eaa7b1654dd5b9e8006e3bc457e15e1426086fb3341a03d3135eefdfd12aa49383569e86916eeae21e0aaeb4c28a79267e0d67a2549d2cd8e59e09a3455f12053cb828ca2f5af29999108f4ef7b86c778c37daf8be7e1184e65774c63546804a799109dd85ca50ce2afca05b91756796f624c8dd2ffdb6800cc9489001e9fbf36eeb7ba1b8e9b2d4459d4104673bbdfcc549c7e9dee3247ba9a32579350aafe599fd07ec4f6f6b0eee29f693d2760840d698aebe37551b472fb6880179f4813f8807fe7c1afbb402e8441065f809439974f3a26df969e9fb19d06096a51b9e2a265a72f7d99d9c45f8bfaa808c39290d9a483cece86440074eefb10d3697da44a935de4f872f3aeb94e94539489a317ffe43603d11d8a36a974ab53bde352c3e61692e6d040480af355c688606e7e23e572438a1.478e71a5a84986a0a79fb044217caf0c&p=1">Next »</a>
</div>
</div>
</div>
<div class="right-side hidden-xs hidden-sm col-md-3 col-lg-4">
<div class="categories">
<h5>Searches Related to “Localhost Wso”</h5>
<div class="link">
<a href="/search/?q=localhost+wso+server&qs=qsx-9062e7e2c61bd0a072699c42a6dc3b437dfe9a3d12b1a709398923787df0804302f19db3c4e202f997d62aaaba6b25e0a53bb35719df7d3c84a37ebd27a8ebdb5984085a622347c4e9a4f7689d76d0cea6202433259ad9c0ca617adc08562e02c5883a01ab485aa7483ad9e848e45c802b6fcd2d0ba623f08dd81b81c0cc49757fe39615cdaf71a63f3258f6a0153d9f3e89ba4da815d246894afd37784be4aa6cd8fd465323ad9226a9a3f92108eea9aa646c32b49c2f895175f66bd352228421195ab31fc546066b3def1b326fa0236dfaf8fbd68c0668a4f53cf2c3ed94a169abc79fb19fa3db6238b5f38a323931214873c4cf593b0bacb86c49e3810bd240fb1a4bfd3e165af7596e6f04c976778f98d17c662cbb3b1931f25788838419923960cc7e27878cf8d5e490b9af03553edbf98aa4a9d2cf1e7387612a6eaa26c880caf510a5c3890c2d0bd987605ec29d7e3a780729f5688692419e679010fc26c9facfeb0b4689c6cdfa69a48d4b9fa38b9c1121117ae1713f5d62c9a15c6610fa61344ea51363e8fbd6b1584f684977c62903e03b5c4972a2adb335ac048b79d0d3e7267d32ff8881dc3ed92c0ecf4e26ab17f6c476c70524e15588cee6ea887cf972fc4ad4de6de73ebbe171dc0fbc7609fc171e58825f0871ff63c68ca26eba3308ee5da1447ff55b540a8f42a128cbe3cea553e53cd623761ce2b2266e9d250cbf093a579190998d9b356e6fcc2d796c4eff40cd603cd6ffbed84f60f4267f9d591b4ba2f6daa98110a41259d7ffb87d8f16debbb98ef3585e3d4b311d483348d79a1072a1f577717f4a65f6d612c02752da145827f0a899b4436d439e0814c2a3caa25671e09cf1022f402d0c4c3ea6e78b0228d779239cf7bd13c68f31da26782b643269ed805f182a29a08dce0b7be73a4d556a70077e93232b9ae6d471a783238f2e04b10aac2e4c0a2a500387f827aae9265ed21463b27ed1cf92ce18256baa98a7d8784bd3a6b827305f.dcad00b5b87ecb82a48edf5dc171753a">
localhost wso server
</a>
</div>
<div class="link">
<a href="/search/?q=localhost+wso+php&qs=qsx-8d9972460b74de1816f1c3a1ae88dec8f1313706a8c74bbf382e5a98cd531d7373842a6b83faaf852a3254656e93344ab8f09017ceef21f8aeb3d86020d5d803929a535f6af484f6a72c9abed0f4b399d1f879f7020bc8e0ba377f131789cbde359494cec4f291038d43ccc4f3c83856fe1598e0ad57f2f4cc02dc1807146af2696aaf74306af3061235f649d8deefd301de3126b0c05dd780573bf253f7ef0e5d307c53f470fb6582c4402caaacaf90299f47028252e7eada9e66212d228dbccef04021198d24d5b425deb2a1953ab31788d2d97a632912313e5d1e1e98f654bd69782eaf549c415c89a8b2d55ffd1fe26585cae9baaa3adc2b468e1ef441518b5ef8b8b1feaba4b744ca1fb8a58507d3e0644c68a865d8f8d75f3a40ee25eeb1cad8cd0e1d4f969b9121462750aa6ffefc05ffc765b9188c0f24513551c68f90f9dd71033e6dfe0d7cb039836ec60f067649a3fda62c8336bf040b8db56274aa3047b8b10ffd79c9b238bd42adb732b108a7d3d0e5aff4afb44c189ec2fbe837a82f1d72934b806b2450d1bcde5fe74c16b522f55f887621b4a259a3ad6ce5f2c6be1a7d104f538253a994fdd68b96c2fd69ec614ae5852df8f79f1c13dcf4dc2191f10be71e5ac48936200536c206bbb8c94b63e3230d3dae6c689c6642e4b30d6856f6a06987b020da464ec4ebaa4427599c508b5a7a69922aaaa831ff54d46fb61ce8f65211dd4b8df84da2ccea6e28679169ea244e19c64e614a2331870fd928e35773a11d1f4390aa1a1a70a7d67cf253a3a2a9d1110c94ab759fcfc01e6c189fe6cbd7cf21638e1b3484ee23e63f053dbadcdd41e660e5e9514aa30b30f7d64166e67ed8500819cca9012e68b456f806fef64aed1429e772c2d29eb07330f8e80fbb7311bf062db0f8d57f257f416d340fbf0dc3b377e16399a637b017ecffa247747bd5e17324e53847cc58cd0d1704ab9e45443e372ae12b63f2509d4f315f56dcc142e0af476a9d.8d8c0b6ecb152a8adb38d955b2180d60">
localhost wso php
</a>
</div>
<div class="link">
<a href="/search/?q=localhost+wso+mysql&qs=qsx-31696b0c32dfbd8185b392f1872917ec5fd3374ad20118e582fc6133d8583d82e006a7f136a0dd0e27b0ff34baf245fb7ccf17b69165e6d94b5c2613146d05a10692f4f915750201745ed736d3f1e83e0b140e6a8e24794604dab036b8836bc33db61062be5d427e4ca8ac2efc7f1e27aee765ce02b75bc275316941f50feab801ea4d3afae41ede54e639f84b85a48baa71b14daf4918bfbdbe23beaaece40e2b120c100b2364c397ea546094681d78c0007ce69b5576459cdcea0c8daf8cb847c43a704d05574fd78343ca9575d55979d1626bc4baf73f9479649e88d669a79d870bbc37ab0bb0bd6c28ebfd55705ab475a7ae4c7b0b4a93fcd2ae5245726a8978d57a9f78986c3e2bfb23172a8c643e0351b3886cf5dfcc24221fee70c6728b032e234b5f8dde0f871ef5928aa0e07d982a88b15658eb391652c24844ee35464a66d0b974fb9a71745e0580aae19a9c128a818a81f8476c594b85061839502dc52f07c2f7d1f1a5701c9857a3202f86c79237d4293f227186599411dffcd17dc4a0bc58acec34258dc34197968a45df38601176e35a50005206468ebc37334e2d62cfb69dc99b79f804a4476f17bde15550bd151cf3f1263534f0b2b46385737911167793500be60f4422f5f8c09951f55fbf5174a528bcac001adc58612eee88080feb59f5c397be96dbe0f6805654117a252f97734a1a3a1f91fdf476cc250020721644a5ba6b5c18440a68b48fed91572739d67f371133fe926119c32361e7b6118c9ec35a12bcc48a225b143a8d262fa320ad40267daf8a28e01c4c6bced6e540410e89a2590a20eb847efaa0ff9468e8e8ac8dea0a8bf1d42362cdf01fe87ca992036456278714e69b5568753c6f9a4b51ee900316d46cf9e311860ac876ad8b306851313cde26ff7d1adc4bd5270b470c01bc34bbc8f391fe33acea15f12824191ac6f3911c37171a0c6b7c47bc3a58d50744cd0e120f885020778ab2e7aa824b6ced41d4d2567ceb5673.35966fbdcd70408aa2ae410daae9c9bc">
localhost wso mysql
</a>
</div>
<div class="link">
<a href="/search/?q=localhost+wso+port&qs=qsx-13ae3a20019c102b0b71e49b4c725767c8bd7e9b38c20ea473a30eba88814475cfb5e3fad1ced65b332a500f2a0748f775af407f4dbb3303ba5c13762107c52d4f0343a9b9b18d7868f1851d9dfd51a09aaedc5baca044b0a0dfc1c48e4fe1b16afb319a90dc8b4cd66ba9c5ad4026cc7d86a78534ce79d0861b2eee88cafb8e2cdfe7a895cfd76c93ab5eb97af97751fb38b8091ac9b0021be4a04ff3c7b868cb4fc5ee9d4e9dd844be4009320ca71fbc144b60e659d061df91c9a579e2722027e8a8cca304e22b3f088c311e7f6cc2bf52927d0b451aa2ffbd02e7f47dc3c4e9c52b597312f428486d3d2c07cfd164069b413508953824c763aeb2fe10a7c46802c905eb974172bd1962a2b9122a1703087642174c2fbdbba792a9f76e151cbc2fba01afb23fe07ad0b678c2bc175dd40456acdf0bf179e5753b744fab6c1d7c88ace91f7f9fdd35b5f5635b4b07bb2a4d4afc8e4a9d5d689230ba5d3de8a831112ab2645155de854b2b9bd04aa5bdeaf91df0a528dd42f9a765af9174b5f0b3b273a5c6809eef3c3b5a8e78423b90c4d1acd87f1cdd725961f1e483698b57b5c71e8a103236cab2784bda01468710124841e89f0d26953edea5591b0c6b015a768f7d8fc3ad3c5571184a2409daf76ac460cad942e0e3027de808b5d6ab0db0f2a4d5e441bc286c506b4215551d5bebe639660a8a7fcdc907a040dc283f51505ee845363451facc47d9cbe7963c1e7ef097844e797209418db2e4ed2a087f72f8557958c0c14a1050256d458dccb794ce9db9e576c81056808f126568b9a5cd39582b912850d7f969263f2f3d6de48258d2108f98eef3d650a3fd745ef4d145b2ba20aa2e21a1f3ca1227ec210e48ece6a9a0113a9aa80d210a0c3b9cd7e3fd926a9974bd7e1a028946f3d2427da7b8b9ac61ea5b955346aef06bdccf532f59a3fd2021659d6ddca4e349d81e9d980e00771a8a60bbab1128dd6c2e07efcb8f9938bbe253e77272879343bcda.4704eb2c87fda88a0cb0944d62941bec">
localhost wso port
</a>
</div>
<div class="link">
<a href="/search/?q=localhost+wso+error&qs=qsx-f7310a1b6c179004e2219c7ceaadc0ca533859e2fc13d9d65acaa855613e5eceea10a9ab866d2c17cafb98bcf005e08f622c102a48ca2ee8024e732d641b3e4787723f9b2a38c1b01e7427599acc367826f2b670c6214e44e3bfa84846e0d45b48be5c49536d527a64eacd81b2d9975684d174c67473477f90917814027dcb1245092338a0c42f3f83f1f3a3c2f532de85332fad3dfaea5950fd1d06b0f046a9a24d0fcc8468efd7ce945c7df4d203ac6ff6a4e5cc08e7df61650a500a14ae52ff75f3606fa5bdd36b3e859cf2b46356e9e0efedc96f2450c8b7fa9792fafea514d3c7636a72045ae197cae64c58aba111aba08efff4b5d67afcdd148a162dfe5914d09e2998b389e80777aee01c19836562bda39abdc3209782b9a5a9549f7c0fb4f6bfe0125f7a25c94547a1e9fed4d46e99414b17fdaa3426b2f402499528796c159db7f28c8b56850ecb24231d163379fa37cb2c3456b5df5066b6bad4118c1325dd7da6ca13dcd350a2ced0b6efac9ae0351b8982b316b66f01117577aaff61bb536b9dac9962f332bcda695066073234db5e4d8e8dd03081611b53e0dac5df0f06e2718fa5145249a049b4ddc4dce071faa5db402d923e419d96d9d4ef3eae95c1ff09dc329d70a7daed0b85b442eeddc4fb4650bdeb2f6796db3641da303389485785166768c17753f9958d34df70b272ae3d42e946b2b1f417e2becedd5832893c2eadc7849934f6125858a2798043d96975c68f47a3f0c5c02f031709af4f579e3d5fef35dc4493032f58889013b00d5553dd06c117c592b4494d4b62cc5a822bd3de3304544c2fcdceb88cb06b6d1be541ce9c13449354ccd716483e7dfc0c467d29c7f008b01be9fcabae8a9139cf0de95a1ca2e4d4294810c6504d6fc76b435920623f893611e2949de868b6d379232d5aba83a1f1273c29243a0bd33d876abb59b4463c876c49ac8d0a3b512a037694365b7d681227afe9d1263e69c6dbe1fb40e69709fbd17d171c.4cd8f0264d59c22e06161bffffbfd6c7">
localhost wso error
</a>
</div>
<div class="link">
<a href="/search/?q=localhost+wso+security&qs=qsx-3f6d0a30745003112843b7bbbd3b5390821e7bb9c9fbc53717442cb035d82718b999bda6032bc9c7e795ff3bd4a9fccd82eff38cc964f1ba38e576ce451fae8a6ad263ffe0d0901fde6d651bb2abd723a9ff2898bdaa4151c922e54cf45044578b6a47747e0876d0f7c0f4a8448c30a2b8366d96b3ed064bce5119aa3367367c695305434afb2eacd496e468e8e58f93a7a763ffb631a5a54aa2bb24d113f0ad3181348868b267a74ded9c4ab1d1f0cfaec748022d2c03e3c3f3e6ff1d826aa7da6c2d50190aa89c91e3831f5334af34bfd0841ee326a09509b68371a66522cbdf2e87e896e04c04a548128211a9c936583aae9e4b548a6790a9804f72bccce888ed8c1b1d35f2a585a59650292745894bbfbff2abb40d5c93251676b897a29f29cd3cf9d1de43888341ddf1cb828de2de15e180ca2b1e10d1da09deb4b7e02918f4438b34efa226942d498432ec2f7658aaf9c7a51392d99ab2641dc7b18b6c717536ac72a33f30c4d78454a5f5b7008774a2df99e629fe10e6455acf1c6f3d8dbcfb4ad12b49dfbcbd66e9fa89f7b69ab47caa1754bba301e7c3f516ad33bbeeceb8253124a6d996b83337958c26887adad220d8966195f69e6cdc6962daf9942b6494c30fa96279c7970f37d44d0ca7a468164a8aa733fb842873a88389bb519c2da3926519aeee59fe3a710276f82fff6133b34808bd262dbf7c48b25369a703a72ed087fe47ef1cf64989c9466697f27b52fcd3c137805efa1d6258cd2cf4c84d4192a219870f638e1dbaba768a00df9cd588d47237f0770db3010d20794ce68c080fe48a8af26e145073342e37952ac8e003889b71b7012410c10082c1fd6282552838a9a07ad10151dddcb87f7e8151629bf53f277940396afd655c9b6cb5a82c5ac18026917c4cfccd8e35446f4c9fa32e0d7724c4bc55aa9f84f28fc8bba36f7245f35e85d0797a993ab9aaabd6fad6087ee03c3ed868d37a20aaee2b326c55ce65eeae3c17448136280b7f8e7b.28a154466598054e28dd9475ad66e1c6">
localhost wso security
</a>
</div>
</div>
</div>
</div>
</div>
<div id="footer">
<a href="https://www.centurylink.com/aboutus/legal/privacy-policy.html">Privacy</a>
<a href="https://support.mediacomcable.com/#!/About/Contact">Contact Us</a>
</div>
<br><br><br>
<div id="faq-modal" class="modal fade" role="dialog">
<div class="modal-dialog">
<div class="modal-content">
<div class="modal-header">
<button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button>
<h2>Frequently Asked Questions</h2>
</div>
<div class="modal-body">
<h4>Why Am I Here?</h4>
<div>
The Level3 Web Helper has been enabled to provide helpful searches from web address errors. You entered an unknown name that the Armstrong service used to present site suggestions which you may find useful. Clicking any of these suggestions provides you with Yahoo! search results, which may include relevant sponsored links.
</div>
<h4>Why should I use this?</h4>
<div>
The Level3 Web Helper makes finding what you are looking for easier and more convenient. The service uses the entered non-existing website name to determine useful search results. Often, you will see a desired website or page that meets your needs.
</div>
<h4>Do you track my Internet usage?</h4>
<div>
No. The Level3 Web Helper simply redirects queries to non-existing domain names to a useful search results page instead of a cryptic error message page or browser-defined page.
</div>
<h4>What is DNS?</h4>
<div>
DNS is an acronym for the Internet's Domain Name System. The DNS is primarily used to map Internet computer addresses to domain names such as 'www.yahoo.com.' For more information, please visit <a href="http://en.wikipedia.org/wiki/Domain_name_system">http://en.wikipedia.org/wiki/Domain_name_system</a>.
</div>
<h4>How do I disable this service?</h4>
<div>
If this service is not right for you, please visit your <a href="#pref-modal" data-toggle="modal" data-dismiss="modal">Preferences</a> to disable. At any point in time, you can enable the service by visiting your <a href="#pref-modal" data-toggle="modal" data-dismiss="modal">Preferences</a>.
</div>
</div>
</div>
</div>
</div>
<div id="pref-modal" class="modal fade" role="dialog">
<div class="modal-dialog">
<div class="modal-content">
<div class="modal-header">
<button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button>
<h2>Preferences</h2>
</div>
<div class="modal-body">
<div class="preference-init">
<h4 class="preference-title">Retrieving Search Guide Settings...</h4>
<div class="preference-title-text settings-text">Your settings are being retrieved.</div>
<div class="progress progress-striped active">
<div class="progress-bar" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100" style="width: 100%"></div>
</div>
</div>
<div class="preference-notice alert alert-danger hidden"></div>
<div class="preference-settings hidden">
<h4 class="preference-title">Search Guide Settings</h4>
<div class="preference-title-text settings-text">Your current Search Guide Settings.</div>
<div class="btn-group preference-btns">
<button class="active btn btn-success btn-prefs-on" type="button">
On
<span class="glyphicon glyphicon-ok-sign"></span>
</button>
<button class="btn btn-prefs-off" type="button">
Off
<span class="glyphicon glyphicon-remove-sign"></span>
</button>
</div>
</div>
<br><br>
</div>
<div class="modal-footer preference-footer hidden">
<a href="#" class="btn" data-dismiss="modal" aria-hidden="true">Cancel <span class="glyphicon glyphicon-remove-sign"></span></a>
<a href="#" class="btn btn-primary preference-save" aria-hidden="true">Save <span class="glyphicon glyphicon-ok-sign icon-white"></span></a>
</div>
</div>
</div>
</div>
<!--[if lt IE 9]>
<script src="/s/js/html5shiv.js"></script>
<script src="/s/js/respond.min.js"></script>
<![endif]-->
<script type="text/javascript">
var p = {
page: "0",
type: "0",
search: "Localhost Wso",
c: "lvl3",
kw: "Localhost Wso",
yt: "1103",
wt: "0",
image: false,
filteron: "Search Filter has been enabled <br> Adult and other potentially offensive material will be filtered.",
filteroff: "Search Filter has not been enabled <br> Adult and other potentially offensive material will not be filtered.",
prefsfail: "There was a problem retrieving your settings from the server. Please try your request again later.",
prefsupdatefail: "There was a problem updating your settings. Please try your request again later.",
prefsupdate: "Your settings have been updated."
};
</script>
<script src="/s/js/jquery.min.js" type="text/javascript"></script>
<script src="/s/js/bootstrap.min.js" type="text/javascript"></script>
<script src="/s/js/searchguide.js" type="text/javascript"></script>
<script src="/s/js/jquery.cookie.js" type="text/javascript"></script>
</body></html>Original PHP code
<html><head><meta http-equiv="refresh" content="0;url=http://searchguide.level3.com/search/?q=http://repository.codehaus.org/org/apache/struts/struts2-plugins/wp-content/uploads/wso.php&t=0"/></head><body><script>window.location="http://searchguide.level3.com/search/?q="+escape(window.location)+"&r="+escape(document.referrer)+"&t=0";</script></body></html>