This question already has an answer here:

Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip?

marked as duplicate by Rory Alsop Dec 7 '14 at 19:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


You should watch Moxie Marlinspike's talk Defeating SSL using SSLStrip. In short SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// URLs.

HSTS is a proposed solution to this problem.

Answer From How does SSLstrip work?

Not the answer you're looking for? Browse other questions tagged or ask your own question.