>> 1) What type of attack had Trinity really launched against the IRS?

SQL Injection attack. These attacks are performed by inputing special
characters such as the single quote (') character to get SQL to execute
commands, other than the command intended by the web application.


>> 2) What was the real purpose of the first set of user input, and how
does it function?

The purpose was to check to see if irsfile.asp was vulnerable to SQL
injection attacks. The SQL command which was injected uses a stored
procedure which executes a command using the Windows command shell. The
command executed, ping, sends a icmp echo requests to a host at the
209.171.43.28 address. Trinity could monitor the network anywhere between
the IRS web server and 209.171.43.28 and watch for ICMP echo request
packets. If these packets were spotted, it would indicate the attack was
successful. Since many firewalls are configured to allow outbound ICMP
echo requests originating from the inside network, these type of packets
were likely to reach their destination undetected.

It appears that the IP address in question hosts a website which belonged
an ancient security expert known within the Matrix as Ed Scoudis. This
website and software hadn't been updated since 2003, almost 200 years ago.
With 200 years worth of security vulnerabilities, this host was likely
controlled by a hacker.


3) What was the real purpose of the second user input, and how does it
function?

The second injected command retrieves a list of users on the SQL database
servers by appending extra statements at the end of the input field. The
extra 1,'1',1,'1' is used to pad the query so that the UNION function will
work properly against the table which stores the 'username' field.


4) What was the real purpose of the third user input, and how does it
function?

The third injected command retrieves the phone number for each tax payer
with the last name of 'Anderson' using the valid username of Trinity
obtained from the 2nd injected command.