I am reading up on SSL stripping and I have a fundamental question on the injection point that makes this MITM attack a success. I understand the typical scenario -
A (victim) <-- plain --> M (MITM) <== SSL ==> B (Server)
Now, lets assume M and A are on the same coffee shop wifi network and M starts proxying A's traffic by ARP poisoning etc. If A is accessing B over SSL, then the traffic M intercepts is encrypted. How is M able to replace HTTPS with HTTP, strip HSTS headers and so on when all he has to work with is an encrypted stream? I imagine the entire payload, including the URL (which would include the protocol 'https://'), is encrypted.
In other words, where is the injection point from which stripping/manipulating encrypted data becomes possible? Does it happen further down on the network stack? Would M be able to switch protocol at the packet level?
Some posts talk about packet capture certs but I'm not sure if there is a well-accepted way to strip SSL without being able to decrypt the data.