Been trying to wrap my head around SSL stripping.
An explanation here writes:
Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs. Those original HTTP URLs still exist, though. Usually, you use 301 or 302 redirects to ensure users can’t reach the HTTP site, but if an attacker can manipulate the redirect, they can still send the user to that page.
How is it possible to get the user to the HTTP page if the server does an automatic redirect?
I am a newbie at networking and attacks so any help is appreciated helping me wrap my head around this!