Attack strength parameter

[Mark]

Hi everyone, I have a question regarding the attack strength parameter.

My doubt is  if it is set to medium, does this mean that not all the available payloads for a certain type of attack are used, but only a moderate number, thus limiting the number of requests sent? 

[Simon Bennetts]

Hi Mark,

Yes, thats right.

DAST scans can take a long time, so its a balance between the number of payloads sent and the time the scan takes.

The Strength parameter is described here: https://www.zaproxy.org/docs/desktop/ui/dialogs/scanpolicy/#strength

Cheers,

Simon