SSL stripping, or SSL downgrade, is an attack vector that downgrades an HTTPS connection to HTTP. This attack is carried out by an attacker who is between the victim and the web server and acts as a transparent proxy. It further maintains a HTTP based downstream connection with the victim and a proper HTTPS upstream connection with the server.
An attack is therefore carried out by the combination of ARP poisoning, SSL stripping, and setting up a transparent proxy between the attacker and the victim. Let's say that a victim wants to visit a site called abc.com. By default, abc.com is served by the server on HTTPS as https://www.abc.com, but when the user types the URL in the browser, abc.com, the browser sends the request as http://www.abc.com to the server, which responds with a 302 response and redirects the user to https://www.abc.com...
