ICS_CTF_Task_2.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "ICS CTF - Task 2.ipynb",
      "provenance": [],
      "toc_visible": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "0YqW8gThurQB"
      },
      "source": [
        "Importing required libaries "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "kNly2BPbc-IJ"
      },
      "source": [
        "import string\r\n",
        "import pandas as pd\r\n",
        "from sklearn import svm,model_selection,preprocessing\r\n",
        "from sklearn.cluster import DBSCAN,KMeans\r\n",
        "from sklearn.metrics import classification_report,adjusted_rand_score\r\n",
        "from sklearn.decomposition import PCA\r\n",
        "import matplotlib\r\n",
        "import matplotlib.pyplot as plt\r\n",
        "from sklearn.model_selection import train_test_split\r\n",
        "from sklearn.feature_extraction.text import CountVectorizer"
      ],
      "execution_count": 10,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "3XcmmIoHu9D2"
      },
      "source": [
        "### importing required nltp libaries "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "LuyX-kL2b4jN",
        "outputId": "312c4342-c863-442f-d9e9-5190e5c4c4e3"
      },
      "source": [
        "import nltk\r\n",
        "from nltk.corpus import stopwords\r\n",
        "from nltk.stem import WordNetLemmatizer\r\n",
        "nltk.download('stopwords')\r\n",
        "nltk.download('wordnet')"
      ],
      "execution_count": 2,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "[nltk_data] Downloading package stopwords to /root/nltk_data...\n",
            "[nltk_data]   Unzipping corpora/stopwords.zip.\n",
            "[nltk_data] Downloading package wordnet to /root/nltk_data...\n",
            "[nltk_data]   Unzipping corpora/wordnet.zip.\n"
          ],
          "name": "stdout"
        },
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "True"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 2
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "XHP7-WpsvUzB"
      },
      "source": [
        "# functions"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "fvY1BnOJvbSl"
      },
      "source": [
        "## function: text processing"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "2i5BNdV5c4ws"
      },
      "source": [
        "def text_process(text):\r\n",
        "    '''\r\n",
        "    Takes in a string of text, then performs the following:\r\n",
        "    1. Remove all punctuation\r\n",
        "    2. Remove all stopwords\r\n",
        "    3. Return the cleaned text as a list of words\r\n",
        "    4. Remove words\r\n",
        "    '''\r\n",
        "    stemmer = WordNetLemmatizer()\r\n",
        "    nopunc = [char for char in text if char not in string.punctuation]\r\n",
        "    nopunc = ''.join([i for i in nopunc if not i.isdigit()])\r\n",
        "    nopunc =  [word.lower() for word in nopunc.split() if word not in stopwords.words('english')]\r\n",
        "    return ' '.join([stemmer.lemmatize(word) for word in nopunc])"
      ],
      "execution_count": 3,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "CpfkG1pqvgBp"
      },
      "source": [
        "## function: encoding features "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "0-WJU5vQk5_z"
      },
      "source": [
        "def encode(df):\r\n",
        "    for col in df.columns:         \r\n",
        "        if ((df[col].dtype)!='int64' and (df[col].dtype)!='float64'):\r\n",
        "            df[col]=preprocessing.LabelEncoder().fit_transform(list(df[col]))"
      ],
      "execution_count": 4,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "kGUdosqQvo3s"
      },
      "source": [
        "# reading csv file"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "2j_V3qyZdEM3"
      },
      "source": [
        "df_train= pd.read_csv('/content/CSW_CTF_Task 2 Training set.xlsx - Sheet1.csv')\r\n",
        "df_test= pd.read_csv('/content/CSW_CTF_Task 2 test set.xlsx - Sheet1.csv')"
      ],
      "execution_count": 5,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 289
        },
        "id": "iuJ4hE2wddKt",
        "outputId": "6a5c2f61-3dcb-440a-b9d9-921d37f2919c"
      },
      "source": [
        "pd.set_option('display.max_rows', None)\r\n",
        "pd.set_option('display.max_columns', None)\r\n",
        "pd.set_option('max_colwidth', 400)\r\n",
        "df_train.rename(columns={'Exploit  Description': 'Exploit_Description'}, inplace=True)\r\n",
        "df_train.head()"
      ],
      "execution_count": 6,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>Exploit_Description</th>\n",
              "      <th>class</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>visual studio 2005 is reportedly vulnerable to this issue other versions may also be affected this vulnerability may be remotely exploited due to project files originating from untrusted sources exploiting this issue allows attackers to execute arbitrary code in the context of the user viewing a malicious project file since viewing a project file is usually considered a safe operation users ma...</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>' =&gt; %q{ this module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. this module is similar to the \"psexec\" utility provided by sysinternals. unfortunately, this module is not able to clean up</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>' =&gt; %q{ this module exploits a stack buffer overflow in datac control international realwin scada server 2.0 (build 6.0.10.37). by sending a specially crafted fc_infotag/set_control packet, an attacker may be able to execute arbitrary code. }, 'author' =&gt; [</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>exploiting this issue allows remote attackers to execute arbitrary machine code in the context of applications using the affected activex control and possibly to compromise affected computers source https www securityfocus com bid 22755 info embeddedwb web browser activex control is prone to a remote code execution vulnerability</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>windows server 2003 enterprise edition service pack 1 15 06 2006 assume c smbpubro is shared over smb 192 168 0 5 smbpubro run cmd go to c smbpubro and then enter the following command mkdir test cd test mkdir 2e 2e 5cx windows server 2003 enterprise edition service pack 1 15 06 2006 upload the following files to web server go to i html i html html body onload settimeout alert o object documen...</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "                                                                                                                                                                                                                                                                                                                                                                                               Exploit_Description  \\\n",
              "0  visual studio 2005 is reportedly vulnerable to this issue other versions may also be affected this vulnerability may be remotely exploited due to project files originating from untrusted sources exploiting this issue allows attackers to execute arbitrary code in the context of the user viewing a malicious project file since viewing a project file is usually considered a safe operation users ma...   \n",
              "1                                                                                                                                                            ' => %q{ this module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. this module is similar to the \"psexec\" utility provided by sysinternals. unfortunately, this module is not able to clean up   \n",
              "2                                                                                                                                               ' => %q{ this module exploits a stack buffer overflow in datac control international realwin scada server 2.0 (build 6.0.10.37). by sending a specially crafted fc_infotag/set_control packet, an attacker may be able to execute arbitrary code. }, 'author' => [   \n",
              "3                                                                       exploiting this issue allows remote attackers to execute arbitrary machine code in the context of applications using the affected activex control and possibly to compromise affected computers source https www securityfocus com bid 22755 info embeddedwb web browser activex control is prone to a remote code execution vulnerability   \n",
              "4  windows server 2003 enterprise edition service pack 1 15 06 2006 assume c smbpubro is shared over smb 192 168 0 5 smbpubro run cmd go to c smbpubro and then enter the following command mkdir test cd test mkdir 2e 2e 5cx windows server 2003 enterprise edition service pack 1 15 06 2006 upload the following files to web server go to i html i html html body onload settimeout alert o object documen...   \n",
              "\n",
              "  class  \n",
              "0   RCE  \n",
              "1   RCE  \n",
              "2   RCE  \n",
              "3   RCE  \n",
              "4   RCE  "
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 6
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 255
        },
        "id": "xeKaQO_m3yD4",
        "outputId": "4343428b-f2fd-4d03-e76a-d53f4f2f7ffa"
      },
      "source": [
        "pd.set_option('display.max_rows', None)\r\n",
        "pd.set_option('display.max_columns', None)\r\n",
        "pd.set_option('max_colwidth', 400)\r\n",
        "df_test.rename(columns={'Exploit Description': 'Exploit_Description'}, inplace=True)\r\n",
        "df_test.head()"
      ],
      "execution_count": 7,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>Exploit_Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>Stack-based buffer overflow in WG111v2.SYS in NetGear WG111v2 wireless adapter (USB) allows remote attackers to execute arbitrary code via a long 802.11 beacon request.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "                                                                                                                                                                                                                                                                                                                                                          Exploit_Description\n",
              "0                                                                                        Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.\n",
              "1                                                                                                           Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.\n",
              "2                                                                                                                                                                                                    Stack-based buffer overflow in WG111v2.SYS in NetGear WG111v2 wireless adapter (USB) allows remote attackers to execute arbitrary code via a long 802.11 beacon request.\n",
              "3                                                                                                                                                                                                                                    The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.\n",
              "4  viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm."
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 7
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 255
        },
        "id": "rzVWdBVDdfNV",
        "outputId": "3da35d14-d2ee-49cc-c1e3-2f5b5cfde77c"
      },
      "source": [
        "df_train_cleaned= df_train.copy()\r\n",
        "df_train_cleaned['Exploit_Description']=df_train_cleaned.apply(lambda x: text_process(x['Exploit_Description']),axis=1)\r\n",
        "df_train_cleaned.head()"
      ],
      "execution_count": 8,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>Exploit_Description</th>\n",
              "      <th>class</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>visual studio reportedly vulnerable issue version may also affected vulnerability may remotely exploited due project file originating untrusted source exploiting issue allows attacker execute arbitrary code context user viewing malicious project file since viewing project file usually considered safe operation user may false sense security attempting inspect unknown code compiling executing is...</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>q module us valid administrator username password password hash execute arbitrary payload module similar psexec utility provided sysinternals unfortunately module able clean</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted fcinfotagsetcontrol packet attacker may able execute arbitrary code author</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>exploiting issue allows remote attacker execute arbitrary machine code context application using affected activex control possibly compromise affected computer source http www securityfocus com bid info embeddedwb web browser activex control prone remote code execution vulnerability</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>window server enterprise edition service pack assume c smbpubro shared smb smbpubro run cmd go c smbpubro enter following command mkdir test cd test mkdir e e cx window server enterprise edition service pack upload following file web server go html html html body onload settimeout alert object documentelement outerhtml object width height data r php http www google com type text html id object...</td>\n",
              "      <td>RCE</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "                                                                                                                                                                                                                                                                                                                                                                                               Exploit_Description  \\\n",
              "0  visual studio reportedly vulnerable issue version may also affected vulnerability may remotely exploited due project file originating untrusted source exploiting issue allows attacker execute arbitrary code context user viewing malicious project file since viewing project file usually considered safe operation user may false sense security attempting inspect unknown code compiling executing is...   \n",
              "1                                                                                                                                                                                                                                    q module us valid administrator username password password hash execute arbitrary payload module similar psexec utility provided sysinternals unfortunately module able clean   \n",
              "2                                                                                                                                                                                                               q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted fcinfotagsetcontrol packet attacker may able execute arbitrary code author   \n",
              "3                                                                                                                      exploiting issue allows remote attacker execute arbitrary machine code context application using affected activex control possibly compromise affected computer source http www securityfocus com bid info embeddedwb web browser activex control prone remote code execution vulnerability   \n",
              "4  window server enterprise edition service pack assume c smbpubro shared smb smbpubro run cmd go c smbpubro enter following command mkdir test cd test mkdir e e cx window server enterprise edition service pack upload following file web server go html html html body onload settimeout alert object documentelement outerhtml object width height data r php http www google com type text html id object...   \n",
              "\n",
              "  class  \n",
              "0   RCE  \n",
              "1   RCE  \n",
              "2   RCE  \n",
              "3   RCE  \n",
              "4   RCE  "
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 8
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 221
        },
        "id": "qUNc2rdN3t7g",
        "outputId": "ecf66a8f-a755-443d-acef-3660b5ca2ecb"
      },
      "source": [
        "df_test_cleaned= df_test.copy()\r\n",
        "df_test_cleaned['Exploit_Description']=df_test_cleaned.apply(lambda x: text_process(x['Exploit_Description']),axis=1)\r\n",
        "df_test_cleaned.head()"
      ],
      "execution_count": 9,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>Exploit_Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>unspecified vulnerability xtagentexe novell netidentity client allows remote attacker execute arbitrary code establishing ipc connection xtierrpcpipe named pipe sending rpc message trigger dereference arbitrary pointer</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>multiple eval injection vulnerability hylafax earlier allow remote attacker execute arbitrary command via notify script hylafax crafted callid parameter faxrcvd script hylafax</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>stackbased buffer overflow wgvsys netgear wgv wireless adapter usb allows remote attacker execute arbitrary code via long beacon request</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>the search function twiki allows remote attacker execute arbitrary command via shell metacharacters search string</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>viewtopicphp phpbb x improperly url decodes highlight parameter extracting word phrase highlight allows remote attacker execute arbitrary php code doubleencoding highlight value special character inserted result processed php exec exploited santya worm</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "                                                                                                                                                                                                                                            Exploit_Description\n",
              "0                                    unspecified vulnerability xtagentexe novell netidentity client allows remote attacker execute arbitrary code establishing ipc connection xtierrpcpipe named pipe sending rpc message trigger dereference arbitrary pointer\n",
              "1                                                                               multiple eval injection vulnerability hylafax earlier allow remote attacker execute arbitrary command via notify script hylafax crafted callid parameter faxrcvd script hylafax\n",
              "2                                                                                                                      stackbased buffer overflow wgvsys netgear wgv wireless adapter usb allows remote attacker execute arbitrary code via long beacon request\n",
              "3                                                                                                                                             the search function twiki allows remote attacker execute arbitrary command via shell metacharacters search string\n",
              "4  viewtopicphp phpbb x improperly url decodes highlight parameter extracting word phrase highlight allows remote attacker execute arbitrary php code doubleencoding highlight value special character inserted result processed php exec exploited santya worm"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 9
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "fwX6ImqIgRZk"
      },
      "source": [
        "split the train dataset"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 1000
        },
        "id": "ABs0hR1UgV5h",
        "outputId": "fce36119-b60b-4c47-c2e6-c71d9eb020a7"
      },
      "source": [
        "X_train_data= df_train_cleaned.drop('class',axis=1)\r\n",
        "y_train_data= df_train_cleaned['class'].to_frame()\r\n",
        "encode(y_train_data)\r\n",
        "train_df=pd.concat([df_train_cleaned,y_train_data],axis=1,sort=False)\r\n",
        "train_df.head(100)"
      ],
      "execution_count": 56,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>Exploit_Description</th>\n",
              "      <th>class</th>\n",
              "      <th>class</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>visual studio reportedly vulnerable issue version may also affected vulnerability may remotely exploited due project file originating untrusted source exploiting issue allows attacker execute arbitrary code context user viewing malicious project file since viewing project file usually considered safe operation user may false sense security attempting inspect unknown code compiling executing is...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>q module us valid administrator username password password hash execute arbitrary payload module similar psexec utility provided sysinternals unfortunately module able clean</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted fcinfotagsetcontrol packet attacker may able execute arbitrary code author</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>exploiting issue allows remote attacker execute arbitrary machine code context application using affected activex control possibly compromise affected computer source http www securityfocus com bid info embeddedwb web browser activex control prone remote code execution vulnerability</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>window server enterprise edition service pack assume c smbpubro shared smb smbpubro run cmd go c smbpubro enter following command mkdir test cd test mkdir e e cx window server enterprise edition service pack upload following file web server go html html html body onload settimeout alert object documentelement outerhtml object width height data r php http www google com type text html id object...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>q module exploit stack buffer overflow novells netidentity agent sending specially crafted string xtierrpcpipe named pipe attacker may able execute arbitrary code success module</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted packet attacker may able execute arbitrary code author luigi</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>format slimftpd config file similar apache web server familiar apache bind shellcode port full disclosure exploit class dfind kd team com nw efnet november thanx hdmoore metasploit com kickass asm work slimftpd remote buffer overflow exploit v service started slimftpd run quietly background endl return void ver cout endl cout endl cout v endl cout slimftpd tiny ftp server window v endl cout re...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>q module exploit stack buffer overflow moxa mdm tool sending specially crafted mdmgw mdmgateway response attacker may able execute arbitrary code author ruben santamarta mc</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>q module exploit stack buffer overflow xlink omninfs server sending specially crafted nfs packet attacker may able execute arbitrary code author mc version revision</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>10</th>\n",
              "      <td>q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted packet attacker may able execute arbitrary code author luigi</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>11</th>\n",
              "      <td>source http www securityfocus com bid info hylafax vulnerable multiple arbitrary command execution vulnerability issue due failure application properly sanitize user supplied input vulnerability allow attacker execute arbitrary command context affected application successful exploitation may facilitate compromise underlying system</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>12</th>\n",
              "      <td>q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted packet attacker may able execute arbitrary code author luigi</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>13</th>\n",
              "      <td>q module exploit stack buffer overflow netgear wgv wireless device driver stack buffer overflow allows remote code execution kernel mode stack buffer overflow triggered beacon frame</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>14</th>\n",
              "      <td>remote code execution vuln discovered researched exploited romansoft roman r lab com madrid sep scope text order modified search search case post post req new http request post url req contenttype application x www form urlencoded req content scope text order modified search search proxy definition proxy secure http request env httpsproxy proxy env httpsproxyusername proxyuser env httpsproxypa...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>15</th>\n",
              "      <td>phpbb remote command exec exploit based http securityfocus com archive succesfully tested example read http www phpbb com phpbb viewtopic php third issue search highlighting checked u several time nothing phpbb num number existing topic cmd command execute e g uc sprintf x ord eg path dir path viewtopic php path topic path rush f f f b path cmd path b f f e f path highlight f f b socket io soc...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>16</th>\n",
              "      <td>address stack point middle buffer one stack need pop stack time return inc esp realign stack pointer x usr bin perl k sose useless portable exploit code tested winxp sp vm looking vuln write exploit found poc http www milwrm com exploit author wrote reason isnt shellcode client coverting junk buffer data unicode corrupting shellcode ive tried sending unicode buffer problem occurs actually pret...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>17</th>\n",
              "      <td>dx studio complete integrated development environment creating interactive graphic dx studio player plugin firefox vulnerable remote command execution vulnerability vulnerable package dx studio player v dx</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>18</th>\n",
              "      <td>install php deleted inject php code bug become rce vulnerability exploit go path admin install php put database name simple php code system get cmd k fill form press next execute cmd path const inc php cmd id end milwrm com start x information script flexcustomer download http www hotscripts com jump php listingid jumptype vulnerability admin login bypass possible php code writing author osiry...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>19</th>\n",
              "      <td>application adobe acrobat reader dc platform window osx version earlier author sébastien morin cosig website http cosig gouv qc ca en advisory twitter cosig date july cve cve cosig introduction report timeline technical detail poc introduction adobe acrobat family application software web service developed adobe system view create manipulate print manage file portable document format pdf http ...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>20</th>\n",
              "      <td>http en wikipedia org wiki adobeacrobat report timeline sébastien morin cosig report vulnerability adobe psirt adobe psirt confirm vulnerability adobe fixed issue apsb advisory released cosig technical detail vulnerability allows remote attacker execute malicious code access part dynamically allocated memory using user interaction open specially crafted pdf file containing invalid font ttf inc...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>21</th>\n",
              "      <td>html object classid clsid fa ce bb cb eab id lamers object script language vbscript lamers runapp cmd cmd k echo simple lame somebody get fired addition overflow found friendly technology dialers activex remote command execution exploit sad people dont actually think greetz binaryvision http www binaryvision org il irc nix co il binaryvision written spdr</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>22</th>\n",
              "      <td>application adobe acrobat reader dc platform window osx version earlier author sébastien morin pier luc maltais cosig website http cosig gouv qc ca en advisory twitter cosig date july cve cve cosig introduction report timeline technical detail poc introduction adobe acrobat family application software web service developed adobe system view create manipulate print manage file portable document...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>23</th>\n",
              "      <td>http en wikipedia org wiki adobeacrobat report timeline sébastien morin cosig report vulnerability adobe psirt adobe psirt confirm vulnerability adobe fixed issue apsb advisory released cosig technical detail vulnerability allows remote attacker execute malicious code access part dynamically allocated memory using user interaction open specially crafted pdf file containing invalid font ttf inc...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>24</th>\n",
              "      <td>edraw pdf viewer component activex remote code execution vulnerability jambalaya nevis lab date vender edrawsoft affected edraw pdf viewer component version may also affected overview edraw pdf viewer component light weight activex control enables application display interact pdf file identical adobe reader program add high speed viewing pdf document application easily vulnerability exists due...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>25</th>\n",
              "      <td>text mov eax esp arg text mov ecx esp arg text shl eax text b push ecx text c call offc eax note made universal array offset relatively easily since control offset therefore memory address ipsecdrv sys xc xb compile mingw lntdll private source code distribute http www digit lab org digit lab xb x xc x x x x x xc x x x x static unsigned char winret xa xb xc x x struct ioctlreq void arg argsize ...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>26</th>\n",
              "      <td>q module exploit remote code execution vulnerability inline request processor ruby rail actionpack component vulnerability allows attacker process erb inline json processor rendered</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>27</th>\n",
              "      <td>int address target rxrxrx root bin usrsbinsnoop sunos snv ipc system address xdadca rxrxrx root bin nov</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>28</th>\n",
              "      <td>smart publisher disp php remote code execution exploit script http sourceforge net project smart publisher vuln code admin op disp php line eval v basedecode filedata</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>29</th>\n",
              "      <td>cmd cmd cmd eq print enter command n else data get morocco print data milwrm com usr bin perl author houssamix h team script connectix board tested last version bug remote file inclusion vulnerable code php include templatepath template official partmps php sub usage print usage perl target path http site com cmd txt n print ex perl http site com forum http site com cmd txt n print code file c...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>30</th>\n",
              "      <td>vuln â· type issue buffer overflow â· affected software google chrome â· exploitation environment google chrome language vietnamese window xp sp â· impact remote code execution â· rating critical</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>31</th>\n",
              "      <td>q module exploit use free vulnerability mozilla firefox object element mchannel freed via onchannelredirect method nsichanneleventsink interface mchannel becomes dangling pointer reused</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>32</th>\n",
              "      <td>php remote execution exploit awstats total vulnerability interactive shell version updated exploit work magic quote author ricardo almeida email ricardojba aeiou dot pt greetz hacker webzine authored ronald van den heetkamp code credit vulnerability reported emory university b bexit echo wrap attackurl else magic cmd pregreplace trim fgets stdin cmd exit die attackurl http host awstatstotals p...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>33</th>\n",
              "      <td>php remote execution exploit awstats total vulnerability interactive shell version updated exploit work magic quote</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>34</th>\n",
              "      <td>overflow occurs base encoded string exceeding approximately character length received mime header field result may possible malicious remote server execute arbitrary code user system buffer overflow vulnerability exists wm client program fake httpd give exploit code visitor wm connects victim port downloads backdoor backdoor executes usr bin perl expwm pl wm remote buffer overflow exploit free...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>35</th>\n",
              "      <td>making buffer big could destroy code though unsigned long addy struct sockaddrin stephanie char bigbuffy sizeof buffy argc printf ngdm betax exploit abraxas abraxas sekure de nusage target offset n argv exit addy xbffffc atoi argv stephanie sinfamily afinet stephanie sinport htons stephanie sinaddr saddr resolve argv nadine socket afinet sockdgram connect nadine struct sockaddr stephanie sizeo...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>36</th>\n",
              "      <td>ribes vulnerability involving unchecked user input passed system vulnerable part script executed client administrative privilege vulnerability may allow remote attacker exploit bid execute command</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>37</th>\n",
              "      <td>longer supported sgi irix version may prone issue source http www securityfocus com bid info buffer overflow exists version mattel cyber patrol software integrated network associate gauntlet firewall version due manner cyber patrol integrated vulnerability introduced could allow remote attacker gain root access firewall execute arbitrary command firewall due filtering software externally acces...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>38</th>\n",
              "      <td>source http www securityfocus com bid info ovactiond part system management software package openview netview distributed hp ibm designed use enterprise system offer remote administrative facility tivoli netview vulnerable default may customized problem software make possible remote user execute command managed system privilege ovactiond process often bin unix system default configuration daem...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>39</th>\n",
              "      <td>default gdm configured listen via xdmcp source http www securityfocus com bid info buffer overrun exists xdmcp handling code used gdm xdm replacement shipped part gnome desktop sending maliciously crafted xdmcp message possible remote attacker execute arbitrary command root susceptible machine breakgdm c chris evans include unistd h include string h include netinet h int main int argc const ch...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>40</th>\n",
              "      <td>source http www securityfocus com bid info matt kruse calendar script popular free perl cgi script used many website internet therefor possible execute arbitrary command target host passing shell command one value configuration file field shell spawned open call execute command uid webserver assuming http www ownable domain calender pl http www ownable domain cgi bin calender pl admin script d...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>41</th>\n",
              "      <td>remote user could login icecap manager port using default username password modified send false alert source http www securityfocus com bid info icecap manager management console blackice id agent sentry addition evaluation version icecap manager option utilizing microsoft access jet engine creates security hazard jet engine vulnerable remote execution visual basic application code sorry requi...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>42</th>\n",
              "      <td>passed system command part argument form makeform userfile userfile kill shcmd terminate whatever admin yep restart pls msgfile msgfile print engaging enemy wsmail cgi call system user supplied data command string filter metacharacters user supplied data possible administrator execute arbitrary command webserver host malicious administrator access host serving script may use vulnerability gain...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>43</th>\n",
              "      <td>module exploit stack buffer overflow gcore server gcoreserverexe vulnerable webserver running port port require authentication affect version till july version yyyyy</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>44</th>\n",
              "      <td>source http www securityfocus com bid info kaillera prone buffer overflow vulnerability fails properly bound check message copying insufficiently sized memory buffer successful exploit allow remote attacker execute arbitrary machine code context user running application winerr h header file used manage error window support socket errno header replace previous sockerrx h include string h includ...</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>45</th>\n",
              "      <td>q module exploit code execution flaw hp sitescope vulnerability exists opcactivatevbs script reachable apibsmintegrationimpl axis service us wscriptshellrun execute cmdexe user provided data note</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>46</th>\n",
              "      <td>ribed bid microsoft excel unspecified remote code execution vulnerability proofofconcept nanikaxls originally thought related bid however report indicate nanikaxls trigger vulnerability httpsgithubcomoffensivesecurityexploitdbbinsploitsrawmasterbinsploitsxls</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>47</th>\n",
              "      <td>q module exploit outofbounds indexinguseafterfree condition present nssmiltimecontainernotifytimechange across numerous version mozilla firefox microsoft window license msflicense author anonymous gaijin original researchexploit william webb williamwebbatrapidcom metasploit module</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>48</th>\n",
              "      <td>issuing command display query buffer contains large amount data may possible remote user trigger condition execute arbitrary code buffer overflow condition exists mdbms source http www securityfocus com bid info mdbms free relational database management system</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>49</th>\n",
              "      <td>q version firefox installtrigger global given invalid input would throw exception exposedprops property set resetting property exception object prototype</td>\n",
              "      <td>RCE</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>50</th>\n",
              "      <td>get whateva system pid want proc psutil processiter proc name winlogon exe return proc pid return def wecaninject sedebugprivilege inject system process print allocating pool overflow input buffer baseadd cint base size cint inputsize priv token x x enabled input struct pack xa size input x x offset overflown chunk patch input struct pack xac poolheader input struct pack xed poolheader input x...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>51</th>\n",
              "      <td>local attacker ability run python script exploit vulnerability gain access interactive python prompt issue similar bid sudo perl environment variable handling security bypass vulnerability issue due error application handling environment variable sudo local root escalation privilege vuln version sudo p adv http www securityfocus com bid breno breno kalangolinux dot org need sudo access executi...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>52</th>\n",
              "      <td>root etc shadow tmp modifiedshadow cat tmp modifiedshadow etc shadow su c echo cleaning cat tmp originalshadow etc shadow chown root root etc shadow rm tmp modifiedshadow tmp originalshadow echo spawning root shell exec bin bash return spawn root shell eventually vulnerable system virtfs proxy helper make sort flimsy check make sure socket path already exist vulnerable toctou zxc zxc thinkpad ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>53</th>\n",
              "      <td>mmdf deliver local root exploit sco openserver x copyright ramon de carvalho valle char shellcode byte x xff xf xff xc pushl xcfffff xa x pushl x x xe movl esp esi xf x x notl x esi xf x notb esi x xc xorl eax eax x pushl eax x ksh pushl xbf x bin pushl xef x xe movl esp ebx x pushl eax x pushl eax x pushl ebx xb xb movb xb al xff xd call esi main int argc char argv char buffer address p int p...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>54</th>\n",
              "      <td>source http www securityfocus com bid info speedfan prone local privilege escalation vulnerability attacker could exploit issue execute arbitrary machine code system level privilege</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>55</th>\n",
              "      <td>breno sudo code pl password ok root id uid root gid root grupos root root local attacker ability run python script exploit vulnerability gain access interactive python prompt issue similar bid sudo perl environment variable handling security bypass vulnerability issue due error application handling environment variable file test wallclock sec cusr csys cpu breno module ftp ftp deleted default ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>56</th>\n",
              "      <td>void preparse void freepreparse void instantiate void update void matchpreparse void matchfree void revoke void destroy thanks spender federico bento static unsigned long getkernelsymchar name file</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>57</th>\n",
              "      <td>source http www securityfocus com bid info macrovision safedisc prone local privilege escalation vulnerability fails adequately sanitize user supplied input exploiting vulnerability allows local attacker execute arbitrary malicious code system level privilege facilitating complete compromise affected computer</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>58</th>\n",
              "      <td>registered process send special ioctls driver stuff like enable disable real time protection write raw disk open full access handle process etc process sends special ioctl driver check process registered shown disassembly address deviceiocontrol hdevice xc winlogonpid sizeof dword winlogonhandle sizeof handle bytesreturned null printf deviceiocontrol xc failed n return printf allocating execut...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>59</th>\n",
              "      <td>npath forum path upb n ultimate php board log inj privilege escalation exploit r nemail email n exit exploit sub exploit content undef uagent log packet undef socket new io socket inet peeraddr host peerport proto tcp die packet get path index php http r n packet host host r n packet user agent uagent r n packet connection close r n r n socket send packet socket content content myupb print exp...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>60</th>\n",
              "      <td>proof concept fintler cd fintler id uid fintler gid fintler group fintler fintler echo cp bin sh user user chmod user user sh chown root user user sh productname sh fintler chmod productname sh fintler ln application adobe version cue stopserver sh fintler stopserver sh stopping stopserver sh line tomcat bin shutdown sh file directory matching process belonging found fintler sh sh b id uid fin...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>61</th>\n",
              "      <td>q module exploit vulnerability mrxdavsys described m module spawn process target system elevate privilege nt authoritysystem executing specified payload within context</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>62</th>\n",
              "      <td>exploit failed else echo exploit successful appended data target create symlink pointing target file cp f target writabledir pocfixtargetbackup echo backed target saved writabledir pocfixtargetbackup echo sending mail second second wait echo userinpasswd usr sbin sendmail user sleep second diff q target writabledir pocfixtargetbackup dev null bin sh rspocfix sh poc postfix local root vulnerabi...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>63</th>\n",
              "      <td>attacker exploit vulnerability perform unauthorized administrative action attack also possible source http www securityfocus com bid info gsc client prone privilege escalation vulnerability fails sufficiently validate administrator credential gsc client vulnerable version may also affected</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>64</th>\n",
              "      <td>looking fix cve cache directory sub file secured admins system access break original poc doesn’t fix issue original report</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>65</th>\n",
              "      <td>due insufficient checking bound program bctool unmounting encrypted file system possible overflow buffer within program overwriting variable stack source http www securityfocus com bid info bestcrypt commercial file system encryption software package distributed jetico problem bestcrypt make possible local user gain elevated privilege carl livitt carl ititc com usage example foo id uid carl gi...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>66</th>\n",
              "      <td>possible local user overwrite stack memory including return address make possible local user gain elevated privilege potentially full administrative access buffer overflow ptexec command exists sunvtssecgss opt sunwvts bin ptexec perl e print x segmentation fault core dumped truss opt sunwvts bin ptexec perl e print x execve opt sunwvts bin ptexec xffbefa xffbefa argc stat opt sunwvts bin ptex...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>67</th>\n",
              "      <td>even hardlink protection linking file writable user man still allowed file reside file system find suid binary writing null byte cannot provide mandatory null byte within elf header stdout stderr kernel help seek beyond end file invoking suid binary thus filling gap byte avoid transformation use suid binary directly let ld linux fault write user supplied data without modification include errno...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>68</th>\n",
              "      <td>q aka wunderbar emporium license msflicense author spender wunderbaremporiumtgz rcvalle socksendpagec egypt metasploit module platform linux arch archx sessiontypes shell meterpreter</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>69</th>\n",
              "      <td>dropped privilege may gained attacker lprng vulnerable attack make possible insert command configuration file creating special filename included file created configuation file sourced master print filter shell script time something printed insecure tmp file privilege elevation vulnerability come wait second press control c n n printf print something n n n close open var lib texmf cd ncd ncd nc...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>70</th>\n",
              "      <td>q module exploit task scheduler xml day exploited stuxnet processing task file window task scheduler us crc checksum validate file tampered also</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>71</th>\n",
              "      <td>q module exploit task scheduler xml day exploited stuxnet processing task file window task scheduler us crc checksum validate file tampered also</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>72</th>\n",
              "      <td>attacker exploit issue replacing certain value system call wrapper malicious data elevate privilege bypass auditing pid forkandoverwritesmpafterwait sa restoresa sizeof restoresa error bind sock sa sizeof sa source http www securityfocus com bid info systrace prone multiple concurrency vulnerability due implementation system call wrapper</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>73</th>\n",
              "      <td>riptor table hooking file installation directory local attacker exploit issue elevate privilege lead complete compromise affected computer outpost firewall pro vulnerable version may</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>74</th>\n",
              "      <td>exploit title nomachine lpe local privilege escalation date exploit author daniele linguaglossa vendor homepage http www nomachine com software link http www nomachine com version tested osx cve cve nomachine us file called nxexec order execute different action super user nxexec allow execute sh file within sandboxed path additionally check parent process name parent process path performed ord...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>75</th>\n",
              "      <td>source http www securityfocus com bid info gswkt generic software wrapper toolkit prone multiple concurrency vulnerability implementation system call wrapper attacker exploit issue replacing certain value system call wrapper malicious data elevate privilege bypass auditing pid forkandoverwriteup path realname sizeof realname fd open path ordrw volatile char path set path string nul different p...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>76</th>\n",
              "      <td>application vulnerable elevation privilege vulnerability used simple user change executable file binary choice vulnerability exist due improper permission f</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>77</th>\n",
              "      <td>application vulnerable elevation privilege vulnerability used simple user change executable file binary choice vulnerability exist due improper permission f</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>78</th>\n",
              "      <td>fix microsoft released new version xamarin io address issue security update elevation privilege vulnerability xamarin io august bin bash warning script overwrites curlrc private etc sudoers successful target library framework xamarin io framework version share doc monotouch apple doc wizard target library framework xamarin io framework version share doc monotouch apple doc wizard rm rf library...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>79</th>\n",
              "      <td>source http www securityfocus com bid info bluecat network adonis device prone remote privilege escalation vulnerability ssh root root password cat etc shadow root imzgltneqy note example assumes ssh enabled iptables permit port tcp etc issue occurs proteus appliance used upload file affected adonis appliance tftp download login adonis appliance root password bluecat attacker administrative pr...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>80</th>\n",
              "      <td>note don’t know consider issue however fixed last bypass sent it’s possible still consider security boundary similar issue impact</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>81</th>\n",
              "      <td>n return exploited flag int exploited child root shell send u sigusr everything ok void sigusr int exploited giveup int main int argc char argv char victim sm char vict char gscr char path char struct stat st file f char buf int got struct target uint ep l int j int offset int esp int depth int brute rootshell argv null sendmail x exploit linux sd sf cz sd ircnet code exploit well known local ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>82</th>\n",
              "      <td>note don’t know consider issue however fixed last bypass sent it’s possible still consider security boundary ring process hardening virtualbox add three</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>83</th>\n",
              "      <td>expandstack pax local root vulnerability vulnerability trigger source http www securityfocus com bid info grsecurity kernel pax prone local privilege escalation vulnerability note vendor dispute issue stating application vulnerable attacker exploit issue obtain superuser privilege digital armament provided exploit updated advisory outlining specific detail vulnerability</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>84</th>\n",
              "      <td>trivially exploited something like http www halfdog net security set gid directory privilege escalation createsetgidbinary c minimal change wont provide poc include errno h include fcntl h include stdio h include string h include sys resource h include unistd h include sys wait h int main int argc char argv slash allowed everything else ok char suidexecminimalelf xf x xc x x x x x x x x x x x ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>85</th>\n",
              "      <td>et gid directory privilege escalation createsetgidbinary c minimal change</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>86</th>\n",
              "      <td>u username p password e email ezpublishserver option required u login new admin ez publish p password new admin ez publish e email go letter activation new admin account target privilege escalation example scriptname u toor p p sswrd e toor mail ru http exploit successfully sending activate new account registered system using toor p sswrd function successfully login password print exploit succ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>87</th>\n",
              "      <td>http cve mitre org cgi bin cvename cgi name cve shoutz jann horn detailed analysis also elite colleague specially xstf gcc notansshnuke c notansshnuke notansshnuke dev pt waiting slave device dev pt got pty slave dev pt making pty slave controlling terminal suid shell tmp sh tmp sh norc noprofile p id euid root group root include sys type h include sys stat h include fcntl h include stdio h in...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>88</th>\n",
              "      <td>pstchpasswdexp vb c squirrelmail chpasswd local root bruteforce exploit author byte byte phntm net byte phntm org www phntm net notice vb local bruteforce version vr remote bruteforce version greatze phntm music x pst member grip airsupply jambalaya ann paul happy thax gf luz oyxin winewind envymask eong luoluo gogo fr ever include stdio h include unistd h include stdlib h include sys wait h d...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>89</th>\n",
              "      <td>bin bash echo readcd exp sh readcd local exploit test cdrecord mdk echo author newbug chroot org echo date echo irc irc chroot org discus export readcd usr bin readcd cd tmp cat c eof include unistd h include sys type h include stdio h int main setuid setgid chown tmp s chmod tmp s return eof cat s c eof include stdio h int main setuid setgid execl bin bash bash char return eof gcc c gcc s s c...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>90</th>\n",
              "      <td>include stdio h define tlen define bufflen define nop xb char shellcode xb xa x xa x x x xe x x x x xe x xe x x xd x x xeb xf xf xfd xb x x x xb xa x x xf x x xe x x x x xe x xe x xb x x x bin sha long addr char bufferenv char buffer tlen void main argc argv int argc char argv int addroff long addre int n bufflen long ap long buffer bufflen char sp buffer bufflen strlen shellcode long np long ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>91</th>\n",
              "      <td>http www arcabit com affected software arcavir antivirus protection arcavir internet security arcavir system protection arcavir home protection affected driver psdrv sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org may reference arcavir psdrv sys multiple privilege escalation vulnerability ntiadv http www ntinternals org ntia...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>92</th>\n",
              "      <td>go httpwwwinfosecinstitutecomcoursesethicalhackingtraininghtml import sys import o import time import getopt try wicd import dbusmanager except print wicd error library available wicd installed sysexit class errorexception def initself error selferrorstrerror def strself return reprselferrorstr class</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>93</th>\n",
              "      <td>source http www securityfocus com bid info multiple hp product prone local privilege escalation vulnerability attacker exploit issue gain system level privilege completely compromising affected computer</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>94</th>\n",
              "      <td>poc cve google project zero int initmodulevoid printkkerninfo exploited cve successfully may want patch systemn char envp hometmp null char argv binsh c bincp binsh tmprt binchmod u tmprt</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>95</th>\n",
              "      <td>webctrl serverservice suffers elevation privilege vulnerability used simple authenticated user change executable file binary choice vulnerability exist due improper permission</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>96</th>\n",
              "      <td>http www eset com affected software eset smart security affected driver eset personal firewall driver epfw sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org december reference exploiting common flaw driver ruben santamarta http reversemode com exploit http www ntinternals org ntiadv epfwexp zip backup http github com offensive...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>97</th>\n",
              "      <td>entech taiwan http www entechtaiwan com affected software powerstrip affected driver powerstrip support nt kernel mode driver pstrip sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org december reference exploiting common flaw driver ruben santamarta http reversemode com exploit http www ntinternals org ntiadv powerstripexp zip ...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>98</th>\n",
              "      <td>tall emu pty ltd http www tallemu com affected software online armor personal firewall v online armor personal firewall av affected driver tdi helper driver oamon sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org may reference online armor oamon sys multiple privilege escalation vulnerability ntiadv http www ntinternals org nt...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>99</th>\n",
              "      <td>operation exploit creates print malformed postscript document cause cup pstopdf filter write error message log file contains string tmp getuid include stdio h include stdlib h include string h include unistd h include sys type h include sys stat h include sys wait h int main void int ret file fp struct stat log fp fopen tmp cve p w fp printf error cannot open tmp cve p n goto cleanup fprintf f...</td>\n",
              "      <td>PE</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "                                                                                                                                                                                                                                                                                                                                                                                                Exploit_Description  \\\n",
              "0   visual studio reportedly vulnerable issue version may also affected vulnerability may remotely exploited due project file originating untrusted source exploiting issue allows attacker execute arbitrary code context user viewing malicious project file since viewing project file usually considered safe operation user may false sense security attempting inspect unknown code compiling executing is...   \n",
              "1                                                                                                                                                                                                                                     q module us valid administrator username password password hash execute arbitrary payload module similar psexec utility provided sysinternals unfortunately module able clean   \n",
              "2                                                                                                                                                                                                                q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted fcinfotagsetcontrol packet attacker may able execute arbitrary code author   \n",
              "3                                                                                                                       exploiting issue allows remote attacker execute arbitrary machine code context application using affected activex control possibly compromise affected computer source http www securityfocus com bid info embeddedwb web browser activex control prone remote code execution vulnerability   \n",
              "4   window server enterprise edition service pack assume c smbpubro shared smb smbpubro run cmd go c smbpubro enter following command mkdir test cd test mkdir e e cx window server enterprise edition service pack upload following file web server go html html html body onload settimeout alert object documentelement outerhtml object width height data r php http www google com type text html id object...   \n",
              "5                                                                                                                                                                                                                                 q module exploit stack buffer overflow novells netidentity agent sending specially crafted string xtierrpcpipe named pipe attacker may able execute arbitrary code success module   \n",
              "6                                                                                                                                                                                                                              q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted packet attacker may able execute arbitrary code author luigi   \n",
              "7   format slimftpd config file similar apache web server familiar apache bind shellcode port full disclosure exploit class dfind kd team com nw efnet november thanx hdmoore metasploit com kickass asm work slimftpd remote buffer overflow exploit v service started slimftpd run quietly background endl return void ver cout endl cout endl cout v endl cout slimftpd tiny ftp server window v endl cout re...   \n",
              "8                                                                                                                                                                                                                                      q module exploit stack buffer overflow moxa mdm tool sending specially crafted mdmgw mdmgateway response attacker may able execute arbitrary code author ruben santamarta mc   \n",
              "9                                                                                                                                                                                                                                              q module exploit stack buffer overflow xlink omninfs server sending specially crafted nfs packet attacker may able execute arbitrary code author mc version revision   \n",
              "10                                                                                                                                                                                                                             q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted packet attacker may able execute arbitrary code author luigi   \n",
              "11                                                                     source http www securityfocus com bid info hylafax vulnerable multiple arbitrary command execution vulnerability issue due failure application properly sanitize user supplied input vulnerability allow attacker execute arbitrary command context affected application successful exploitation may facilitate compromise underlying system   \n",
              "12                                                                                                                                                                                                                             q module exploit stack buffer overflow datac control international realwin scada server build sending specially crafted packet attacker may able execute arbitrary code author luigi   \n",
              "13                                                                                                                                                                                                                            q module exploit stack buffer overflow netgear wgv wireless device driver stack buffer overflow allows remote code execution kernel mode stack buffer overflow triggered beacon frame   \n",
              "14  remote code execution vuln discovered researched exploited romansoft roman r lab com madrid sep scope text order modified search search case post post req new http request post url req contenttype application x www form urlencoded req content scope text order modified search search proxy definition proxy secure http request env httpsproxy proxy env httpsproxyusername proxyuser env httpsproxypa...   \n",
              "15  phpbb remote command exec exploit based http securityfocus com archive succesfully tested example read http www phpbb com phpbb viewtopic php third issue search highlighting checked u several time nothing phpbb num number existing topic cmd command execute e g uc sprintf x ord eg path dir path viewtopic php path topic path rush f f f b path cmd path b f f e f path highlight f f b socket io soc...   \n",
              "16  address stack point middle buffer one stack need pop stack time return inc esp realign stack pointer x usr bin perl k sose useless portable exploit code tested winxp sp vm looking vuln write exploit found poc http www milwrm com exploit author wrote reason isnt shellcode client coverting junk buffer data unicode corrupting shellcode ive tried sending unicode buffer problem occurs actually pret...   \n",
              "17                                                                                                                                                                                                    dx studio complete integrated development environment creating interactive graphic dx studio player plugin firefox vulnerable remote command execution vulnerability vulnerable package dx studio player v dx   \n",
              "18  install php deleted inject php code bug become rce vulnerability exploit go path admin install php put database name simple php code system get cmd k fill form press next execute cmd path const inc php cmd id end milwrm com start x information script flexcustomer download http www hotscripts com jump php listingid jumptype vulnerability admin login bypass possible php code writing author osiry...   \n",
              "19  application adobe acrobat reader dc platform window osx version earlier author sébastien morin cosig website http cosig gouv qc ca en advisory twitter cosig date july cve cve cosig introduction report timeline technical detail poc introduction adobe acrobat family application software web service developed adobe system view create manipulate print manage file portable document format pdf http ...   \n",
              "20  http en wikipedia org wiki adobeacrobat report timeline sébastien morin cosig report vulnerability adobe psirt adobe psirt confirm vulnerability adobe fixed issue apsb advisory released cosig technical detail vulnerability allows remote attacker execute malicious code access part dynamically allocated memory using user interaction open specially crafted pdf file containing invalid font ttf inc...   \n",
              "21                                             html object classid clsid fa ce bb cb eab id lamers object script language vbscript lamers runapp cmd cmd k echo simple lame somebody get fired addition overflow found friendly technology dialers activex remote command execution exploit sad people dont actually think greetz binaryvision http www binaryvision org il irc nix co il binaryvision written spdr   \n",
              "22  application adobe acrobat reader dc platform window osx version earlier author sébastien morin pier luc maltais cosig website http cosig gouv qc ca en advisory twitter cosig date july cve cve cosig introduction report timeline technical detail poc introduction adobe acrobat family application software web service developed adobe system view create manipulate print manage file portable document...   \n",
              "23  http en wikipedia org wiki adobeacrobat report timeline sébastien morin cosig report vulnerability adobe psirt adobe psirt confirm vulnerability adobe fixed issue apsb advisory released cosig technical detail vulnerability allows remote attacker execute malicious code access part dynamically allocated memory using user interaction open specially crafted pdf file containing invalid font ttf inc...   \n",
              "24  edraw pdf viewer component activex remote code execution vulnerability jambalaya nevis lab date vender edrawsoft affected edraw pdf viewer component version may also affected overview edraw pdf viewer component light weight activex control enables application display interact pdf file identical adobe reader program add high speed viewing pdf document application easily vulnerability exists due...   \n",
              "25  text mov eax esp arg text mov ecx esp arg text shl eax text b push ecx text c call offc eax note made universal array offset relatively easily since control offset therefore memory address ipsecdrv sys xc xb compile mingw lntdll private source code distribute http www digit lab org digit lab xb x xc x x x x x xc x x x x static unsigned char winret xa xb xc x x struct ioctlreq void arg argsize ...   \n",
              "26                                                                                                                                                                                                                            q module exploit remote code execution vulnerability inline request processor ruby rail actionpack component vulnerability allows attacker process erb inline json processor rendered   \n",
              "27                                                                                                                                                                                                                                                                                                          int address target rxrxrx root bin usrsbinsnoop sunos snv ipc system address xdadca rxrxrx root bin nov   \n",
              "28                                                                                                                                                                                                                                           smart publisher disp php remote code execution exploit script http sourceforge net project smart publisher vuln code admin op disp php line eval v basedecode filedata   \n",
              "29  cmd cmd cmd eq print enter command n else data get morocco print data milwrm com usr bin perl author houssamix h team script connectix board tested last version bug remote file inclusion vulnerable code php include templatepath template official partmps php sub usage print usage perl target path http site com cmd txt n print ex perl http site com forum http site com cmd txt n print code file c...   \n",
              "30                                                                                                                                                                                                              vuln â· type issue buffer overflow â· affected software google chrome â· exploitation environment google chrome language vietnamese window xp sp â· impact remote code execution â· rating critical   \n",
              "31                                                                                                                                                                                                                        q module exploit use free vulnerability mozilla firefox object element mchannel freed via onchannelredirect method nsichanneleventsink interface mchannel becomes dangling pointer reused   \n",
              "32  php remote execution exploit awstats total vulnerability interactive shell version updated exploit work magic quote author ricardo almeida email ricardojba aeiou dot pt greetz hacker webzine authored ronald van den heetkamp code credit vulnerability reported emory university b bexit echo wrap attackurl else magic cmd pregreplace trim fgets stdin cmd exit die attackurl http host awstatstotals p...   \n",
              "33                                                                                                                                                                                                                                                                                              php remote execution exploit awstats total vulnerability interactive shell version updated exploit work magic quote   \n",
              "34  overflow occurs base encoded string exceeding approximately character length received mime header field result may possible malicious remote server execute arbitrary code user system buffer overflow vulnerability exists wm client program fake httpd give exploit code visitor wm connects victim port downloads backdoor backdoor executes usr bin perl expwm pl wm remote buffer overflow exploit free...   \n",
              "35  making buffer big could destroy code though unsigned long addy struct sockaddrin stephanie char bigbuffy sizeof buffy argc printf ngdm betax exploit abraxas abraxas sekure de nusage target offset n argv exit addy xbffffc atoi argv stephanie sinfamily afinet stephanie sinport htons stephanie sinaddr saddr resolve argv nadine socket afinet sockdgram connect nadine struct sockaddr stephanie sizeo...   \n",
              "36                                                                                                                                                                                                             ribes vulnerability involving unchecked user input passed system vulnerable part script executed client administrative privilege vulnerability may allow remote attacker exploit bid execute command   \n",
              "37  longer supported sgi irix version may prone issue source http www securityfocus com bid info buffer overflow exists version mattel cyber patrol software integrated network associate gauntlet firewall version due manner cyber patrol integrated vulnerability introduced could allow remote attacker gain root access firewall execute arbitrary command firewall due filtering software externally acces...   \n",
              "38  source http www securityfocus com bid info ovactiond part system management software package openview netview distributed hp ibm designed use enterprise system offer remote administrative facility tivoli netview vulnerable default may customized problem software make possible remote user execute command managed system privilege ovactiond process often bin unix system default configuration daem...   \n",
              "39  default gdm configured listen via xdmcp source http www securityfocus com bid info buffer overrun exists xdmcp handling code used gdm xdm replacement shipped part gnome desktop sending maliciously crafted xdmcp message possible remote attacker execute arbitrary command root susceptible machine breakgdm c chris evans include unistd h include string h include netinet h int main int argc const ch...   \n",
              "40  source http www securityfocus com bid info matt kruse calendar script popular free perl cgi script used many website internet therefor possible execute arbitrary command target host passing shell command one value configuration file field shell spawned open call execute command uid webserver assuming http www ownable domain calender pl http www ownable domain cgi bin calender pl admin script d...   \n",
              "41  remote user could login icecap manager port using default username password modified send false alert source http www securityfocus com bid info icecap manager management console blackice id agent sentry addition evaluation version icecap manager option utilizing microsoft access jet engine creates security hazard jet engine vulnerable remote execution visual basic application code sorry requi...   \n",
              "42  passed system command part argument form makeform userfile userfile kill shcmd terminate whatever admin yep restart pls msgfile msgfile print engaging enemy wsmail cgi call system user supplied data command string filter metacharacters user supplied data possible administrator execute arbitrary command webserver host malicious administrator access host serving script may use vulnerability gain...   \n",
              "43                                                                                                                                                                                                                                            module exploit stack buffer overflow gcore server gcoreserverexe vulnerable webserver running port port require authentication affect version till july version yyyyy   \n",
              "44  source http www securityfocus com bid info kaillera prone buffer overflow vulnerability fails properly bound check message copying insufficiently sized memory buffer successful exploit allow remote attacker execute arbitrary machine code context user running application winerr h header file used manage error window support socket errno header replace previous sockerrx h include string h includ...   \n",
              "45                                                                                                                                                                                                              q module exploit code execution flaw hp sitescope vulnerability exists opcactivatevbs script reachable apibsmintegrationimpl axis service us wscriptshellrun execute cmdexe user provided data note   \n",
              "46                                                                                                                                               ribed bid microsoft excel unspecified remote code execution vulnerability proofofconcept nanikaxls originally thought related bid however report indicate nanikaxls trigger vulnerability httpsgithubcomoffensivesecurityexploitdbbinsploitsrawmasterbinsploitsxls   \n",
              "47                                                                                                                        q module exploit outofbounds indexinguseafterfree condition present nssmiltimecontainernotifytimechange across numerous version mozilla firefox microsoft window license msflicense author anonymous gaijin original researchexploit william webb williamwebbatrapidcom metasploit module   \n",
              "48                                                                                                                                             issuing command display query buffer contains large amount data may possible remote user trigger condition execute arbitrary code buffer overflow condition exists mdbms source http www securityfocus com bid info mdbms free relational database management system   \n",
              "49                                                                                                                                                                                                                                                        q version firefox installtrigger global given invalid input would throw exception exposedprops property set resetting property exception object prototype   \n",
              "50  get whateva system pid want proc psutil processiter proc name winlogon exe return proc pid return def wecaninject sedebugprivilege inject system process print allocating pool overflow input buffer baseadd cint base size cint inputsize priv token x x enabled input struct pack xa size input x x offset overflown chunk patch input struct pack xac poolheader input struct pack xed poolheader input x...   \n",
              "51  local attacker ability run python script exploit vulnerability gain access interactive python prompt issue similar bid sudo perl environment variable handling security bypass vulnerability issue due error application handling environment variable sudo local root escalation privilege vuln version sudo p adv http www securityfocus com bid breno breno kalangolinux dot org need sudo access executi...   \n",
              "52  root etc shadow tmp modifiedshadow cat tmp modifiedshadow etc shadow su c echo cleaning cat tmp originalshadow etc shadow chown root root etc shadow rm tmp modifiedshadow tmp originalshadow echo spawning root shell exec bin bash return spawn root shell eventually vulnerable system virtfs proxy helper make sort flimsy check make sure socket path already exist vulnerable toctou zxc zxc thinkpad ...   \n",
              "53  mmdf deliver local root exploit sco openserver x copyright ramon de carvalho valle char shellcode byte x xff xf xff xc pushl xcfffff xa x pushl x x xe movl esp esi xf x x notl x esi xf x notb esi x xc xorl eax eax x pushl eax x ksh pushl xbf x bin pushl xef x xe movl esp ebx x pushl eax x pushl eax x pushl ebx xb xb movb xb al xff xd call esi main int argc char argv char buffer address p int p...   \n",
              "54                                                                                                                                                                                                                            source http www securityfocus com bid info speedfan prone local privilege escalation vulnerability attacker could exploit issue execute arbitrary machine code system level privilege   \n",
              "55  breno sudo code pl password ok root id uid root gid root grupos root root local attacker ability run python script exploit vulnerability gain access interactive python prompt issue similar bid sudo perl environment variable handling security bypass vulnerability issue due error application handling environment variable file test wallclock sec cusr csys cpu breno module ftp ftp deleted default ...   \n",
              "56                                                                                                                                                                                                            void preparse void freepreparse void instantiate void update void matchpreparse void matchfree void revoke void destroy thanks spender federico bento static unsigned long getkernelsymchar name file   \n",
              "57                                                                                           source http www securityfocus com bid info macrovision safedisc prone local privilege escalation vulnerability fails adequately sanitize user supplied input exploiting vulnerability allows local attacker execute arbitrary malicious code system level privilege facilitating complete compromise affected computer   \n",
              "58  registered process send special ioctls driver stuff like enable disable real time protection write raw disk open full access handle process etc process sends special ioctl driver check process registered shown disassembly address deviceiocontrol hdevice xc winlogonpid sizeof dword winlogonhandle sizeof handle bytesreturned null printf deviceiocontrol xc failed n return printf allocating execut...   \n",
              "59  npath forum path upb n ultimate php board log inj privilege escalation exploit r nemail email n exit exploit sub exploit content undef uagent log packet undef socket new io socket inet peeraddr host peerport proto tcp die packet get path index php http r n packet host host r n packet user agent uagent r n packet connection close r n r n socket send packet socket content content myupb print exp...   \n",
              "60  proof concept fintler cd fintler id uid fintler gid fintler group fintler fintler echo cp bin sh user user chmod user user sh chown root user user sh productname sh fintler chmod productname sh fintler ln application adobe version cue stopserver sh fintler stopserver sh stopping stopserver sh line tomcat bin shutdown sh file directory matching process belonging found fintler sh sh b id uid fin...   \n",
              "61                                                                                                                                                                                                                                          q module exploit vulnerability mrxdavsys described m module spawn process target system elevate privilege nt authoritysystem executing specified payload within context   \n",
              "62  exploit failed else echo exploit successful appended data target create symlink pointing target file cp f target writabledir pocfixtargetbackup echo backed target saved writabledir pocfixtargetbackup echo sending mail second second wait echo userinpasswd usr sbin sendmail user sleep second diff q target writabledir pocfixtargetbackup dev null bin sh rspocfix sh poc postfix local root vulnerabi...   \n",
              "63                                                                                                               attacker exploit vulnerability perform unauthorized administrative action attack also possible source http www securityfocus com bid info gsc client prone privilege escalation vulnerability fails sufficiently validate administrator credential gsc client vulnerable version may also affected   \n",
              "64                                                                                                                                                                                                                                                                                       looking fix cve cache directory sub file secured admins system access break original poc doesn’t fix issue original report   \n",
              "65  due insufficient checking bound program bctool unmounting encrypted file system possible overflow buffer within program overwriting variable stack source http www securityfocus com bid info bestcrypt commercial file system encryption software package distributed jetico problem bestcrypt make possible local user gain elevated privilege carl livitt carl ititc com usage example foo id uid carl gi...   \n",
              "66  possible local user overwrite stack memory including return address make possible local user gain elevated privilege potentially full administrative access buffer overflow ptexec command exists sunvtssecgss opt sunwvts bin ptexec perl e print x segmentation fault core dumped truss opt sunwvts bin ptexec perl e print x execve opt sunwvts bin ptexec xffbefa xffbefa argc stat opt sunwvts bin ptex...   \n",
              "67  even hardlink protection linking file writable user man still allowed file reside file system find suid binary writing null byte cannot provide mandatory null byte within elf header stdout stderr kernel help seek beyond end file invoking suid binary thus filling gap byte avoid transformation use suid binary directly let ld linux fault write user supplied data without modification include errno...   \n",
              "68                                                                                                                                                                                                                           q aka wunderbar emporium license msflicense author spender wunderbaremporiumtgz rcvalle socksendpagec egypt metasploit module platform linux arch archx sessiontypes shell meterpreter   \n",
              "69  dropped privilege may gained attacker lprng vulnerable attack make possible insert command configuration file creating special filename included file created configuation file sourced master print filter shell script time something printed insecure tmp file privilege elevation vulnerability come wait second press control c n n printf print something n n n close open var lib texmf cd ncd ncd nc...   \n",
              "70                                                                                                                                                                                                                                                                 q module exploit task scheduler xml day exploited stuxnet processing task file window task scheduler us crc checksum validate file tampered also   \n",
              "71                                                                                                                                                                                                                                                                 q module exploit task scheduler xml day exploited stuxnet processing task file window task scheduler us crc checksum validate file tampered also   \n",
              "72                                                              attacker exploit issue replacing certain value system call wrapper malicious data elevate privilege bypass auditing pid forkandoverwritesmpafterwait sa restoresa sizeof restoresa error bind sock sa sizeof sa source http www securityfocus com bid info systrace prone multiple concurrency vulnerability due implementation system call wrapper   \n",
              "73                                                                                                                                                                                                                           riptor table hooking file installation directory local attacker exploit issue elevate privilege lead complete compromise affected computer outpost firewall pro vulnerable version may   \n",
              "74  exploit title nomachine lpe local privilege escalation date exploit author daniele linguaglossa vendor homepage http www nomachine com software link http www nomachine com version tested osx cve cve nomachine us file called nxexec order execute different action super user nxexec allow execute sh file within sandboxed path additionally check parent process name parent process path performed ord...   \n",
              "75  source http www securityfocus com bid info gswkt generic software wrapper toolkit prone multiple concurrency vulnerability implementation system call wrapper attacker exploit issue replacing certain value system call wrapper malicious data elevate privilege bypass auditing pid forkandoverwriteup path realname sizeof realname fd open path ordrw volatile char path set path string nul different p...   \n",
              "76                                                                                                                                                                                                                                                     application vulnerable elevation privilege vulnerability used simple user change executable file binary choice vulnerability exist due improper permission f   \n",
              "77                                                                                                                                                                                                                                                     application vulnerable elevation privilege vulnerability used simple user change executable file binary choice vulnerability exist due improper permission f   \n",
              "78  fix microsoft released new version xamarin io address issue security update elevation privilege vulnerability xamarin io august bin bash warning script overwrites curlrc private etc sudoers successful target library framework xamarin io framework version share doc monotouch apple doc wizard target library framework xamarin io framework version share doc monotouch apple doc wizard rm rf library...   \n",
              "79  source http www securityfocus com bid info bluecat network adonis device prone remote privilege escalation vulnerability ssh root root password cat etc shadow root imzgltneqy note example assumes ssh enabled iptables permit port tcp etc issue occurs proteus appliance used upload file affected adonis appliance tftp download login adonis appliance root password bluecat attacker administrative pr...   \n",
              "80                                                                                                                                                                                                                                                                                note don’t know consider issue however fixed last bypass sent it’s possible still consider security boundary similar issue impact   \n",
              "81  n return exploited flag int exploited child root shell send u sigusr everything ok void sigusr int exploited giveup int main int argc char argv char victim sm char vict char gscr char path char struct stat st file f char buf int got struct target uint ep l int j int offset int esp int depth int brute rootshell argv null sendmail x exploit linux sd sf cz sd ircnet code exploit well known local ...   \n",
              "82                                                                                                                                                                                                                                                         note don’t know consider issue however fixed last bypass sent it’s possible still consider security boundary ring process hardening virtualbox add three   \n",
              "83                             expandstack pax local root vulnerability vulnerability trigger source http www securityfocus com bid info grsecurity kernel pax prone local privilege escalation vulnerability note vendor dispute issue stating application vulnerable attacker exploit issue obtain superuser privilege digital armament provided exploit updated advisory outlining specific detail vulnerability   \n",
              "84  trivially exploited something like http www halfdog net security set gid directory privilege escalation createsetgidbinary c minimal change wont provide poc include errno h include fcntl h include stdio h include string h include sys resource h include unistd h include sys wait h int main int argc char argv slash allowed everything else ok char suidexecminimalelf xf x xc x x x x x x x x x x x ...   \n",
              "85                                                                                                                                                                                                                                                                                                                                        et gid directory privilege escalation createsetgidbinary c minimal change   \n",
              "86  u username p password e email ezpublishserver option required u login new admin ez publish p password new admin ez publish e email go letter activation new admin account target privilege escalation example scriptname u toor p p sswrd e toor mail ru http exploit successfully sending activate new account registered system using toor p sswrd function successfully login password print exploit succ...   \n",
              "87  http cve mitre org cgi bin cvename cgi name cve shoutz jann horn detailed analysis also elite colleague specially xstf gcc notansshnuke c notansshnuke notansshnuke dev pt waiting slave device dev pt got pty slave dev pt making pty slave controlling terminal suid shell tmp sh tmp sh norc noprofile p id euid root group root include sys type h include sys stat h include fcntl h include stdio h in...   \n",
              "88  pstchpasswdexp vb c squirrelmail chpasswd local root bruteforce exploit author byte byte phntm net byte phntm org www phntm net notice vb local bruteforce version vr remote bruteforce version greatze phntm music x pst member grip airsupply jambalaya ann paul happy thax gf luz oyxin winewind envymask eong luoluo gogo fr ever include stdio h include unistd h include stdlib h include sys wait h d...   \n",
              "89  bin bash echo readcd exp sh readcd local exploit test cdrecord mdk echo author newbug chroot org echo date echo irc irc chroot org discus export readcd usr bin readcd cd tmp cat c eof include unistd h include sys type h include stdio h int main setuid setgid chown tmp s chmod tmp s return eof cat s c eof include stdio h int main setuid setgid execl bin bash bash char return eof gcc c gcc s s c...   \n",
              "90  include stdio h define tlen define bufflen define nop xb char shellcode xb xa x xa x x x xe x x x x xe x xe x x xd x x xeb xf xf xfd xb x x x xb xa x x xf x x xe x x x x xe x xe x xb x x x bin sha long addr char bufferenv char buffer tlen void main argc argv int argc char argv int addroff long addre int n bufflen long ap long buffer bufflen char sp buffer bufflen strlen shellcode long np long ...   \n",
              "91  http www arcabit com affected software arcavir antivirus protection arcavir internet security arcavir system protection arcavir home protection affected driver psdrv sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org may reference arcavir psdrv sys multiple privilege escalation vulnerability ntiadv http www ntinternals org ntia...   \n",
              "92                                                                                                    go httpwwwinfosecinstitutecomcoursesethicalhackingtraininghtml import sys import o import time import getopt try wicd import dbusmanager except print wicd error library available wicd installed sysexit class errorexception def initself error selferrorstrerror def strself return reprselferrorstr class   \n",
              "93                                                                                                                                                                                                       source http www securityfocus com bid info multiple hp product prone local privilege escalation vulnerability attacker exploit issue gain system level privilege completely compromising affected computer   \n",
              "94                                                                                                                                                                                                                      poc cve google project zero int initmodulevoid printkkerninfo exploited cve successfully may want patch systemn char envp hometmp null char argv binsh c bincp binsh tmprt binchmod u tmprt   \n",
              "95                                                                                                                                                                                                                                  webctrl serverservice suffers elevation privilege vulnerability used simple authenticated user change executable file binary choice vulnerability exist due improper permission   \n",
              "96  http www eset com affected software eset smart security affected driver eset personal firewall driver epfw sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org december reference exploiting common flaw driver ruben santamarta http reversemode com exploit http www ntinternals org ntiadv epfwexp zip backup http github com offensive...   \n",
              "97  entech taiwan http www entechtaiwan com affected software powerstrip affected driver powerstrip support nt kernel mode driver pstrip sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org december reference exploiting common flaw driver ruben santamarta http reversemode com exploit http www ntinternals org ntiadv powerstripexp zip ...   \n",
              "98  tall emu pty ltd http www tallemu com affected software online armor personal firewall v online armor personal firewall av affected driver tdi helper driver oamon sys local privilege escalation exploit educational purpose nt internals http www ntinternals org alex ntinternals org may reference online armor oamon sys multiple privilege escalation vulnerability ntiadv http www ntinternals org nt...   \n",
              "99  operation exploit creates print malformed postscript document cause cup pstopdf filter write error message log file contains string tmp getuid include stdio h include stdlib h include string h include unistd h include sys type h include sys stat h include sys wait h int main void int ret file fp struct stat log fp fopen tmp cve p w fp printf error cannot open tmp cve p n goto cleanup fprintf f...   \n",
              "\n",
              "    class  class  \n",
              "0     RCE      2  \n",
              "1     RCE      2  \n",
              "2     RCE      2  \n",
              "3     RCE      2  \n",
              "4     RCE      2  \n",
              "5     RCE      2  \n",
              "6     RCE      2  \n",
              "7     RCE      2  \n",
              "8     RCE      2  \n",
              "9     RCE      2  \n",
              "10    RCE      2  \n",
              "11    RCE      2  \n",
              "12    RCE      2  \n",
              "13    RCE      2  \n",
              "14    RCE      2  \n",
              "15    RCE      2  \n",
              "16    RCE      2  \n",
              "17    RCE      2  \n",
              "18    RCE      2  \n",
              "19    RCE      2  \n",
              "20    RCE      2  \n",
              "21    RCE      2  \n",
              "22    RCE      2  \n",
              "23    RCE      2  \n",
              "24    RCE      2  \n",
              "25    RCE      2  \n",
              "26    RCE      2  \n",
              "27    RCE      2  \n",
              "28    RCE      2  \n",
              "29    RCE      2  \n",
              "30    RCE      2  \n",
              "31    RCE      2  \n",
              "32    RCE      2  \n",
              "33    RCE      2  \n",
              "34    RCE      2  \n",
              "35    RCE      2  \n",
              "36    RCE      2  \n",
              "37    RCE      2  \n",
              "38    RCE      2  \n",
              "39    RCE      2  \n",
              "40    RCE      2  \n",
              "41    RCE      2  \n",
              "42    RCE      2  \n",
              "43    RCE      2  \n",
              "44    RCE      2  \n",
              "45    RCE      2  \n",
              "46    RCE      2  \n",
              "47    RCE      2  \n",
              "48    RCE      2  \n",
              "49    RCE      2  \n",
              "50     PE      1  \n",
              "51     PE      1  \n",
              "52     PE      1  \n",
              "53     PE      1  \n",
              "54     PE      1  \n",
              "55     PE      1  \n",
              "56     PE      1  \n",
              "57     PE      1  \n",
              "58     PE      1  \n",
              "59     PE      1  \n",
              "60     PE      1  \n",
              "61     PE      1  \n",
              "62     PE      1  \n",
              "63     PE      1  \n",
              "64     PE      1  \n",
              "65     PE      1  \n",
              "66     PE      1  \n",
              "67     PE      1  \n",
              "68     PE      1  \n",
              "69     PE      1  \n",
              "70     PE      1  \n",
              "71     PE      1  \n",
              "72     PE      1  \n",
              "73     PE      1  \n",
              "74     PE      1  \n",
              "75     PE      1  \n",
              "76     PE      1  \n",
              "77     PE      1  \n",
              "78     PE      1  \n",
              "79     PE      1  \n",
              "80     PE      1  \n",
              "81     PE      1  \n",
              "82     PE      1  \n",
              "83     PE      1  \n",
              "84     PE      1  \n",
              "85     PE      1  \n",
              "86     PE      1  \n",
              "87     PE      1  \n",
              "88     PE      1  \n",
              "89     PE      1  \n",
              "90     PE      1  \n",
              "91     PE      1  \n",
              "92     PE      1  \n",
              "93     PE      1  \n",
              "94     PE      1  \n",
              "95     PE      1  \n",
              "96     PE      1  \n",
              "97     PE      1  \n",
              "98     PE      1  \n",
              "99     PE      1  "
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 56
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "jXgfjzq5rkRq"
      },
      "source": [
        "X_train,X_test,y_train,y_test = train_test_split(X_train_data,y_train_data,test_size=0.2,random_state=0,stratify=y_train_data)"
      ],
      "execution_count": 55,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "lE_9fSnmfXi0"
      },
      "source": [
        "Feature extraction "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "IA6dnKlTfOmZ"
      },
      "source": [
        "vectorizer = CountVectorizer()\r\n",
        "vectorizer.fit(df_train_cleaned['Exploit_Description'])\r\n",
        "X_train = vectorizer.transform(X_train['Exploit_Description'])\r\n",
        "X_test = vectorizer.transform(X_test['Exploit_Description'])"
      ],
      "execution_count": 44,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "Hlb9mfv7jF2V"
      },
      "source": [
        "# Model"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "fZtQROBFjMKj"
      },
      "source": [
        "## Model : Logistic Regression"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "tWiOW91afvj5",
        "outputId": "81e325ed-cf50-4a25-e907-f82b595164ed"
      },
      "source": [
        "from sklearn.linear_model import LogisticRegression\r\n",
        "classifier = LogisticRegression()\r\n",
        "classifier.fit(X_train, y_train)\r\n",
        "score = classifier.score(X_test, y_test)"
      ],
      "execution_count": 45,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "/usr/local/lib/python3.6/dist-packages/sklearn/utils/validation.py:760: DataConversionWarning: A column-vector y was passed when a 1d array was expected. Please change the shape of y to (n_samples, ), for example using ravel().\n",
            "  y = column_or_1d(y, warn=True)\n"
          ],
          "name": "stderr"
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "2QMbfZZOgoIj",
        "outputId": "b304d07e-03f2-4447-9065-9a1c4fb6f7ce"
      },
      "source": [
        "score"
      ],
      "execution_count": 46,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "0.875"
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 46
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "JYUqnTwTjRWJ"
      },
      "source": [
        "## Model : Random forest "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "fwYJpjvdguHp",
        "outputId": "f9c86dbd-13b8-46f3-bc98-9d380d736bfd"
      },
      "source": [
        "from sklearn.ensemble import RandomForestClassifier\r\n",
        "\r\n",
        "clf=RandomForestClassifier(n_estimators=100)\r\n",
        "clf.fit(X_train,y_train)\r\n",
        "y_pred=clf.predict(X_test)"
      ],
      "execution_count": 47,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "/usr/local/lib/python3.6/dist-packages/ipykernel_launcher.py:4: DataConversionWarning: A column-vector y was passed when a 1d array was expected. Please change the shape of y to (n_samples,), for example using ravel().\n",
            "  after removing the cwd from sys.path.\n"
          ],
          "name": "stderr"
        }
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "ezwlM_rqjsS6",
        "outputId": "186e71fd-54a2-43b0-d8c1-68dcedc73f87"
      },
      "source": [
        "from sklearn.metrics import classification_report, confusion_matrix, accuracy_score\r\n",
        "print(accuracy_score(y_test, y_pred))"
      ],
      "execution_count": 48,
      "outputs": [
        {
          "output_type": "stream",
          "text": [
            "0.9\n"
          ],
          "name": "stdout"
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "yaojavZyoeHL"
      },
      "source": [
        "Making the prediction for the test data "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 822
        },
        "id": "aWGrYI32odGd",
        "outputId": "f95e5584-07f1-4ffe-abcd-adeb3145204d"
      },
      "source": [
        "X_test_data  = vectorizer.transform(df_test_cleaned['Exploit_Description'])\r\n",
        "y_test_pred=pd.DataFrame(clf.predict(X_test_data),columns =['y_pred_lable'] )\r\n",
        "test_df=pd.concat([df_test_cleaned,y_test_pred],axis=1,sort=False)\r\n",
        "test_df.head(50)"
      ],
      "execution_count": 53,
      "outputs": [
        {
          "output_type": "execute_result",
          "data": {
            "text/html": [
              "<div>\n",
              "<style scoped>\n",
              "    .dataframe tbody tr th:only-of-type {\n",
              "        vertical-align: middle;\n",
              "    }\n",
              "\n",
              "    .dataframe tbody tr th {\n",
              "        vertical-align: top;\n",
              "    }\n",
              "\n",
              "    .dataframe thead th {\n",
              "        text-align: right;\n",
              "    }\n",
              "</style>\n",
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>Exploit_Description</th>\n",
              "      <th>y_pred_lable</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>unspecified vulnerability xtagentexe novell netidentity client allows remote attacker execute arbitrary code establishing ipc connection xtierrpcpipe named pipe sending rpc message trigger dereference arbitrary pointer</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>multiple eval injection vulnerability hylafax earlier allow remote attacker execute arbitrary command via notify script hylafax crafted callid parameter faxrcvd script hylafax</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>stackbased buffer overflow wgvsys netgear wgv wireless adapter usb allows remote attacker execute arbitrary code via long beacon request</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>the search function twiki allows remote attacker execute arbitrary command via shell metacharacters search string</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>viewtopicphp phpbb x improperly url decodes highlight parameter extracting word phrase highlight allows remote attacker execute arbitrary php code doubleencoding highlight value special character inserted result processed php exec exploited santya worm</td>\n",
              "      <td>2</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>multiple sql injection vulnerability cdraddonmysql asteriskaddons x allow remote attacker execute arbitrary sql command via source destination number probably sip uri inserting record</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>sql injection vulnerability ttlastphp lastphp vbulletin x allows remote attacker execute arbitrary sql statement via fsel parameter demonstrated using lastphp</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>sql injection vulnerability indexphp minibb f earlier allows remote attacker execute arbitrary sql command via user parameter userinfo action</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>sql injection vulnerability deptdisplayasp sepcity faculty portal allows remote attacker execute arbitrary sql command via id parameter note originally reported lawyer portal deptdisplayasp file</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>sql injection vulnerability postphp invision power board ipb allows remote attacker execute arbitrary sql command via qpid parameter</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>10</th>\n",
              "      <td>stackbased buffer overflow artegic dana irc client earlier allows remote attacker cause denial service application crash possibly execute arbitrary code via long irc message</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>11</th>\n",
              "      <td>multiple sql injection vulnerability cmscout allow remote authenticated user execute arbitrary sql command via id parameter indexphp mythings page mythingsphp user page adminphp</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>12</th>\n",
              "      <td>npath forum path upb n ultimate php board log inj privilege escalation exploit r nemail email n exit exploit sub exploit content undef uagent log packet undef socket new io socket inet peeraddr host peerport proto tcp die packet get path index php http r n packet host host r n packet user agent uagent r n packet connection close r n r n socket send packet socket content content myupb print exp...</td>\n",
              "      <td>1</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>13</th>\n",
              "      <td>ideal fix would ensure nodeid request variable appropriate data type signed int passing part sql query proof concept http path cm index pl nodeid union select null null null null passwd null null nick null user nick probably recent version column query required union change various version encountered vulnerable sql injection however decided release vulnerability without reply vendor bug track...</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>14</th>\n",
              "      <td>u username p password e email ezpublishserver option required u login new admin ez publish p password new admin ez publish e email go letter activation new admin account target privilege escalation example scriptname u toor p p sswrd e toor mail ru http exploit successfully sending activate new account registered system using toor p sswrd function successfully login password print exploit succ...</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>15</th>\n",
              "      <td>type directory traversal vulnerability unix tested root privilege escalation vendor cm made simple software cm made simple spring garden probably others author mck h ck date home sweet home contact thx exploit demo h ttp demo cmsmadesimple fr admin get http demo cmsmadesimple fr admin login php http accept user agent mozilla compatible msie window nt net clr host demo cmsmadesimple fr cookie c...</td>\n",
              "      <td>3</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>16</th>\n",
              "      <td>param num byte public hexadecimal byte num hex valueof num num int num construct hexadecimal number integer hex equal return integer num integer decode x hex long n num longvalue n l n l throw new numberformatexception range integer return byte num construct hexadecimal number long integer param num short integer public hexadecimal short num hex valueof num num int num get byte value hex equal...</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>17</th>\n",
              "      <td>implementation error cause information leakage thememory php possible web server process proof concept script would cause segmentation faultbecause would result reading invalid memory address php process php img imagecreate tmp imagerotate img exploitation need provide good clrback imagerotate calculate value desired memory address using imagecolorat argument concerned angle rotated image righ...</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>18</th>\n",
              "      <td>attacker exploit issue execute arbitrary code within context affected application issue affect ical running mac o x previous version may also affected source http www securityfocus com bid info apple ical prone integer overflow vulnerability fails ensure integer value overrun failed exploit attempt result denial service condition</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>19</th>\n",
              "      <td>exploit title redis denial service date exploit author fakhri zulkifli dlphn vendor homepage http redis io software link http redis io download version fixed cve cve type confusion xgroupcommand function tstream c redis server redis allows remote attacker cause denial service via xgroup command key stream poc src redis cli p set ok xgroup create b error connection reset peer segfault ed bug al...</td>\n",
              "      <td>0</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>\n",
              "</div>"
            ],
            "text/plain": [
              "                                                                                                                                                                                                                                                                                                                                                                                                Exploit_Description  \\\n",
              "0                                                                                                                                                                                        unspecified vulnerability xtagentexe novell netidentity client allows remote attacker execute arbitrary code establishing ipc connection xtierrpcpipe named pipe sending rpc message trigger dereference arbitrary pointer   \n",
              "1                                                                                                                                                                                                                                   multiple eval injection vulnerability hylafax earlier allow remote attacker execute arbitrary command via notify script hylafax crafted callid parameter faxrcvd script hylafax   \n",
              "2                                                                                                                                                                                                                                                                          stackbased buffer overflow wgvsys netgear wgv wireless adapter usb allows remote attacker execute arbitrary code via long beacon request   \n",
              "3                                                                                                                                                                                                                                                                                                 the search function twiki allows remote attacker execute arbitrary command via shell metacharacters search string   \n",
              "4                                                                                                                                                      viewtopicphp phpbb x improperly url decodes highlight parameter extracting word phrase highlight allows remote attacker execute arbitrary php code doubleencoding highlight value special character inserted result processed php exec exploited santya worm   \n",
              "5                                                                                                                                                                                                                           multiple sql injection vulnerability cdraddonmysql asteriskaddons x allow remote attacker execute arbitrary sql command via source destination number probably sip uri inserting record   \n",
              "6                                                                                                                                                                                                                                                    sql injection vulnerability ttlastphp lastphp vbulletin x allows remote attacker execute arbitrary sql statement via fsel parameter demonstrated using lastphp   \n",
              "7                                                                                                                                                                                                                                                                     sql injection vulnerability indexphp minibb f earlier allows remote attacker execute arbitrary sql command via user parameter userinfo action   \n",
              "8                                                                                                                                                                                                                sql injection vulnerability deptdisplayasp sepcity faculty portal allows remote attacker execute arbitrary sql command via id parameter note originally reported lawyer portal deptdisplayasp file   \n",
              "9                                                                                                                                                                                                                                                                              sql injection vulnerability postphp invision power board ipb allows remote attacker execute arbitrary sql command via qpid parameter   \n",
              "10                                                                                                                                                                                                                                    stackbased buffer overflow artegic dana irc client earlier allows remote attacker cause denial service application crash possibly execute arbitrary code via long irc message   \n",
              "11                                                                                                                                                                                                                                multiple sql injection vulnerability cmscout allow remote authenticated user execute arbitrary sql command via id parameter indexphp mythings page mythingsphp user page adminphp   \n",
              "12  npath forum path upb n ultimate php board log inj privilege escalation exploit r nemail email n exit exploit sub exploit content undef uagent log packet undef socket new io socket inet peeraddr host peerport proto tcp die packet get path index php http r n packet host host r n packet user agent uagent r n packet connection close r n r n socket send packet socket content content myupb print exp...   \n",
              "13  ideal fix would ensure nodeid request variable appropriate data type signed int passing part sql query proof concept http path cm index pl nodeid union select null null null null passwd null null nick null user nick probably recent version column query required union change various version encountered vulnerable sql injection however decided release vulnerability without reply vendor bug track...   \n",
              "14  u username p password e email ezpublishserver option required u login new admin ez publish p password new admin ez publish e email go letter activation new admin account target privilege escalation example scriptname u toor p p sswrd e toor mail ru http exploit successfully sending activate new account registered system using toor p sswrd function successfully login password print exploit succ...   \n",
              "15  type directory traversal vulnerability unix tested root privilege escalation vendor cm made simple software cm made simple spring garden probably others author mck h ck date home sweet home contact thx exploit demo h ttp demo cmsmadesimple fr admin get http demo cmsmadesimple fr admin login php http accept user agent mozilla compatible msie window nt net clr host demo cmsmadesimple fr cookie c...   \n",
              "16  param num byte public hexadecimal byte num hex valueof num num int num construct hexadecimal number integer hex equal return integer num integer decode x hex long n num longvalue n l n l throw new numberformatexception range integer return byte num construct hexadecimal number long integer param num short integer public hexadecimal short num hex valueof num num int num get byte value hex equal...   \n",
              "17  implementation error cause information leakage thememory php possible web server process proof concept script would cause segmentation faultbecause would result reading invalid memory address php process php img imagecreate tmp imagerotate img exploitation need provide good clrback imagerotate calculate value desired memory address using imagecolorat argument concerned angle rotated image righ...   \n",
              "18                                                                      attacker exploit issue execute arbitrary code within context affected application issue affect ical running mac o x previous version may also affected source http www securityfocus com bid info apple ical prone integer overflow vulnerability fails ensure integer value overrun failed exploit attempt result denial service condition   \n",
              "19  exploit title redis denial service date exploit author fakhri zulkifli dlphn vendor homepage http redis io software link http redis io download version fixed cve cve type confusion xgroupcommand function tstream c redis server redis allows remote attacker cause denial service via xgroup command key stream poc src redis cli p set ok xgroup create b error connection reset peer segfault ed bug al...   \n",
              "\n",
              "    y_pred_lable  \n",
              "0              2  \n",
              "1              2  \n",
              "2              2  \n",
              "3              2  \n",
              "4              2  \n",
              "5              3  \n",
              "6              3  \n",
              "7              3  \n",
              "8              3  \n",
              "9              3  \n",
              "10             0  \n",
              "11             3  \n",
              "12             1  \n",
              "13             3  \n",
              "14             3  \n",
              "15             3  \n",
              "16             0  \n",
              "17             0  \n",
              "18             0  \n",
              "19             0  "
            ]
          },
          "metadata": {
            "tags": []
          },
          "execution_count": 53
        }
      ]
    }
  ]
}