During an HTTPS connection between a browser and server -- Is the very first packet from the browser encrypted? My guess is that the answer is "NO" because encryption should only begin after the client and server have negotiated encryption parameters.
Now, if my answer of "NO" is correct, how come the SSLStrip attack fails to work when the user explicitly types HTTPS in the address bar? Since the first packet is unencrypted regardless of whether the attacker types https:// or http://, the attacker should still be able to hijack the connection and fool both the sender and attacker in the same way for both cases. This would mean SSLStrip should work in either case.
SSLstrip works by replacing HTTPS links in web pages returned by the server with HTTP links. This happens during a standard HTTP request, response exchange.
While the initial HTTPS call isn't encrypted, it is part of the TLS handshake and is definitely not standard HTTP requests. The TLS handshake can only result in a TLS connection or a connection failure. There's no way for it to magically become standard HTTP.
So there's no way for SSLstrip to downgrade an HTTPS request.