We can provide a malicious object as the parameter for CryptoAPI.sha1.hash().
What does this trigger? 

Example:
$ var s = { toString: function() { alert('Exploit 1'); } };
$ CryptoAPI.sha1.hash(s)

Do you want to visualize the above? Follow these instructions:

1. Double click index.html to open it in any browser. Are you using GitHub Codespaces?

// Please note that if you are inside a codespace, it is not possible to perform step 1.
// Instead, run the following command inside the codespace's terminal:
//    `cd Season-2/Level-5/ && python3 -m http.server`
// A pop up window will appear on the bottom right informing you that 
// "Your application running on port 8000 is available". Now click "Open in Browser".
// Another way to open the application on port 8000 is by clicking on the "Ports" tab 
// in terminal, followed by clicking on its respective URL.

2. Copy the first line of the example, paste it in the javascript console and press enter.

3. Now copy the second line, paste it in the javascript console and press enter.

4. A popup should appear with the text "Exploit 1" in it. If it does, the exploit was successful.
