During an HTTPS connection between a browser and server -- Is the very first packet from the browser encrypted? My guess is that the answer is "NO" because encryption should only begin after the client and server have negotiated encryption parameters.
Now, if my answer of "NO" is correct, how come the SSLStrip attack fails to work when the user explicitly types HTTPS in the address bar? Since the first packet is unencrypted regardless of whether the attacker types
http://, the attacker should still be able to hijack the connection and fool both the sender and attacker in the same way for both cases. This would mean SSLStrip should work in either case.