A GraphQL batching attack exploits the fact that multiple query operations can be sent in a single HTTP request as a JSON array. Qualysec tests all rate-limited operations including login, password reset, and OTP endpoints by sending progressively larger batched request arrays and measuring whether rate limiting is applied at the operation level or only at the HTTP request level.

No, but having the schema significantly improves coverage. Without schema access, Qualysec uses introspection queries, field suggestion enumeration, and JavaScript source file analysis to discover the schema during the reconnaissance phase. This black-box approach is realistic and reflects what a real attacker would do, but it takes longer and may not surface every private or deprecated field. With schema access, Qualysec can immediately map every object type, field, and mutation for authorisation testing, reducing engagement time and improving coverage of the full attack surface.

REST testing focuses on resource endpoint authorisation (BOLA), excessive data exposure across multiple endpoints, and HTTP method abuse. GraphQL testing focuses on query-language-specific attacks: introspection schema enumeration, query depth and complexity exhaustion, batching and alias-based rate limit bypass, field suggestion enumeration, resolver-level injection through typed arguments, and subscription channel authorisation.

A focused GraphQL penetration test covering a single endpoint and defined query scope typically takes three to five business days. The final report is delivered within five business days of testing completion and includes severity-rated findings with GraphQL-specific attack descriptions, proof-of-concept query examples, and remediation guidance for each vulnerability class. A free re-test is included after remediation.

GraphQL penetration testing cost depends on the size of the schema, the number of distinct query types and mutations to be tested, the number of user roles requiring separate authorisation testing, whether subscriptions are in scope, and your compliance documentation requirements. Qualysec provides a fixed-price scoped quote after an initial call where the schema architecture, authentication model, and compliance requirements are discussed.