Yes, SSL stripping is a man-in-the-middle attack (MiTM). The attacker establishes a proxy server as a bridge between your device and a web server. Your device connects to the attacker’s server with HTTP, and the hacker’s device is connected to the website over an HTTPS secured connection.  In SSL stripping, the cybercriminal captures all requests from your device and passes them on to the remote server, so neither you nor the website knows your data is in the wrong hands.