ZAP doesn’t just throw a load of payloads at a target to see what happens :) The payloads are targeted based on the responses to other payloads so that it hopefully zeros in on specific vulnerabilities. However there a various options: Try out the custom payloads add-on which is supported by some of the existing rules Change the existing rules to improve them - this blog post is a good place to start: Hacking ZAP: Active Scan Rules - if you do improve them then please submit pull requests :...
