How do you turn a Linux host into a transparent man-in-the-middle for a client's web traffic?

Make it the client's default gateway, enable IP forwarding, and redirect TCP ports 80 and 443 with nftables to the local port of mitmproxy running in transparent mode.

A man-in-the-middle must sit on the path of the traffic. An attacker gets there by spoofing (ARP or DHCP spoofing, a rogue Wi-Fi hotspot); but the default gateway of a network is there by design: every packet to the outside passes through it. Whoever runs the gateway (an employer, a hotel, an airport hotspot) is in the MitM position without any attack.

The setup:

1. Install mitmproxy (via pipx, which installs the Python tool into its own virtual environment and puts it on the PATH).
2. Enable forwarding so the host routes packets that are not addressed to it: net.ipv4.ip_forward=1, net.ipv6.conf.all.forwarding=1, and send_redirects=0 so it does not send ICMP redirects telling clients to bypass it.
3. Redirect web traffic into the proxy:

   nft add table inet nat
   nft add chain inet nat prerouting { type nat hook prerouting priority 0 \; }
   nft add rule inet nat prerouting iifname "ens3" tcp dport 80  redirect to :8080
   nft add rule inet nat prerouting iifname "ens3" tcp dport 443 redirect to :8080
   

4. Start mitmproxy --mode transparent. "Transparent" means the client is not configured to use a proxy; it thinks it talks to the real server.
5. Point the victim's default gateway at this host.

Everything else is still forwarded normally; only HTTP and HTTPS are diverted into the proxy.

Go deeper:

• mitmproxy docs: Transparent proxying — the forwarding and redirect rules per OS.
• nftables wiki: Performing NAT — redirect in a prerouting nat chain.
• Wikipedia: Man-in-the-middle attack — ways to get into the path, and defences.