I've been tearing my hair out for the past few days about this.

I have an EC2 instance spun up with Ubuntu on it and have set up my AWS instance so that all traffic accessing port 8088 and 8090 are allowed in. Going off of this link, I thought it would be easy to just use the GUI with my browser, since I don't have access to the GUI on my EC2 instance. So I run this command (from the tutorial):

docker run -u zap -p 8088:8088 -p 8090:8090 -i owasp/zap2docker-stable zap-webswing.sh

It starts up without saying anything. But when I go to my public EC2 IP with port 8088, I just get an error saying "This site can't be reached." I've successfully set up jenkins on this EC2 instance on a different port, and that is accessible.. so I'm unsure why I can't access this port when trying to run OWASP/ZAP.

When I run sudo iptables -t nat -L -n I get the following:

target     prot opt source               destination
DOCKER     all  --              ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --           !          ADDRTYPE match dst-type LOCAL

target     prot opt source               destination
MASQUERADE  tcp  --            tcp dpt:8088

Chain DOCKER (2 references)
target     prot opt source               destination
RETURN     all  --  
DNAT       tcp  --              tcp dpt:8088 to:

I'm not great with this sort of thing.. so I have no clue what's really going on or what I need to change? But is there anyway I can start OWASP/ZAP and have it work when I go to my public IP and the port I specified?

  • What are your security group rules? – EEAA Feb 25 '17 at 0:57
  • @EEAA TCP, and all IP addresses are open to port 8088 and 8090 – Alex Feb 25 '17 at 0:59

Sorry to bring up this old question, but I've had problems with running ZAP inside a docker container in the past (really, AWS ECS). In my case, I didn't really want to set the port ahead of time (let docker manage the port specifically, since I might be running more than one zap instance on the same host - we needed to do this in a CI environment, and things get weird if you move that on to AWS ECS). There were two problems I discovered with ZAP+Docker+Random Port listener:

  1. ZAP will only listen on the port that you specify, and if an incoming request was to a different port, then ZAP simply ignores the traffic, with a result similar to "This site can't be reached"
  2. By corollary, it will also only listen to traffic that originated with the same hostname, too. So ZAP thinks it's listening on localhost, and any traffic that appears to be destined for something other than localhost it ignores.

I think that the two are really the same. In my case, I had to cheat to get it to work. I had to add an nginx reverse proxy to the zap container (I used nginx because it is light weight and easy to configure for this). Basically, the flow looked something like:

Me -> nginx in container --(rewrite host header to localhost:8080)--> ZAP listener

There was no other processing on the nginx side, just literally "listen for traffic on a fixed port (Docker manages the external port), rewrite the host headers to localhost:8080 then send the traffic on to localhost:8080 (where ZAP was listening). It's kind of hacky, but it worked for me.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.