Let’s take a scenario in which there is a Victim machine (A),an Attacker machine (B) and a server(C). SSL strip is running on the attacker machine, which is a proxy server. Hence, there is no direct connection between the victim and the server.
Victim A wants to transfer money from his account using an online banking service and he enters the following URL into the address bar of the browser:
In the background, the victim’s browser that is connected to the attacker’s machine waits for the response from the server. Attacker B forwards the victim A’s request and waits for the response from the bank server. The connection between B and C is secure, which means that all the traffic that is transferred between them (B & C) is through the SSL tunnel.
The Bank server responds with the login page that has the following URL:
At this stage, the attacker has access to the login page. Next, attacker(B) modifies the response from the server from https to http and sends it to victim (A), which results in the browser now being addressed to http://www.foobank.com/online_banking.
At this point, the victim has access to the internet banking login page with an insecure connection with the attacker. From this point onwards, all the victim’s requests go out in the Plain text format and the attacker can sniff the data and collect the credentials.
The Server thinks it has successfully established the connection, which in this scenario is between the attacker and the server (i.e., between B & C), while the victim (A) also thinks that it is a legitimate Server (C).
SSLStrip doesn't depend on the server's behavior, it depends on the
client. If you can get the client to make the request over HTTP,
instead of HTTPS, you can perform the attack, even if the server only
supports HTTPS. HSTS prevents the browser from performing the plain
HTTP request in the first place (on subsequent requests).
Google is using only HTTPS and using HSTS header against SSLStrip attacks. Because SSLStrip attacks can occur even if web server is using only HTTPS.