Attack demos

Three pages built on the Halden demo site. The injected script only edits its own page and sends nothing.

1. Classic crypto checkout

   Pay-to-address with a copy button. A hacked script swaps the address on the page and in the clipboard.

2. Sitebound checkout, same script

   No address to swap. The payee comes from the registry entry for the origin the browser signed.

3. Fake site embedding the frame

   Runs on its own origin (127.0.0.1:8003), not the real site's. Includes the overlay case, a known limit.