TLS Stripping (also called SSL Stripping) is a man-in-the-middle attack that downgrades HTTPS connections to HTTP, allowing attackers to intercept and read encrypted traffic in plaintext.
When a victim attempts to connect to a website, the attacker intercepts the connection and establishes an HTTPS connection to the legitimate server while serving HTTP to the victim. The victim sees an unencrypted connection, but the traffic appears to work normally.
1. Victim types "bank.com" in browser
- Browser requests: http://bank.com
2. Attacker intercepts request
- Attacker connects to: https://bank.com (HTTPS)
- Server responds with HTTPS content
3. Attacker serves content to victim
- Attacker serves: http://bank.com (HTTP)
- Rewrites all https:// links to http://
4. Victim submits credentials over HTTP
- Attacker captures plaintext credentials
- Forwards to legitimate server over HTTPS