Is it possible to make a transparent MITM attack (without an intermediate ip)?

Question

Information Security

Hello.
There are 3 different physical computers/servers:
1) Computer and User's Browser (ip address 1.1.1.1)
2) Web server (ip address 2.2.2.2)
3) MITM attacker's computer (ip address 3.3.3.3) which is between browser and web server.

A standard MITM attack on an HTTPS connection means opening a site no longer from the ip of the web server 2.2.2.2, but from the ip of the attacker 3.3.3.3. As a result, the browser will display a message that the root certificate is unknown.

Question: is a transparent MITM attack (for example, changing the content of a page) possible, as if there is no MITM attacker? Those. the web browser connects as it should to the web server with ip address 2.2.2.2, but the attacker completely passes the traffic through itself.

Answer 1

It is possible :)
You have described the scenario of a corporate proxy with bumping :) True, for its operation one, but extremely essential condition is needed - on computer 1.1.1.1, the trusted root certificates must contain a certificate / CA certificate that will be used on 3.3.3.3
Otherwise it won't work, because you don't have a session key, you won't be able to "fake" the connection between the client and you.
https is just invented in order to weed out such smart-ass people and the requirement to install "state certificates" - it is not without reason enforcing - because there is no way without it.

Answer 2

https is just created as protection against such attacks
, the only way is to attack through a plug-in in the client's browser, which is actually what the attackers do, buying popular and not so popular extensions and adding their own script launcher on each site (to collect private information and advertising) , through the extension, you can replace the content by loading logic from the server, changing or adding scripts, etc.
Another - an attack through a browser change on the client side (by all means a new browser is 'stealed' to you, such as how Yandex does it or how Google has already done it with the whole world), here the procedure for processing and controlling an encrypted connection is on the browser's conscience (for example, you can log keys encryption of each session, in this case, logging encrypted dumps from the provider, plus these keys will allow them to at least be decrypted, well, this method is inconvenient for data substitution)

Answer 3

Even if you're smart enough to replace packages along the way, without the server's private key, you won't be able to properly sign them.
The client browser will see either a left certificate, or a sudden jump from HTTPS to HTTP and start cursing.