You must own the target assets or hold written authorization from the owner. We sign a penetration testing authorization agreement with every client, defining scope, time windows and emergency contacts before testing begins.

All attacks run in isolated sandbox containers under rate control. Exploit verification follows the No PoC, No Finding principle: we stop the moment we have proof, minimizing impact.

An HTML/Markdown report (with the approval audit trail), an ATT&CK / WSTG / Kill Chain coverage matrix, a SARIF 2.1 export and remediation advice — plus one retest.

Timelines are scoped per engagement, typically 5–10 business days. Rush jobs are negotiable.

The testing scope (domains / IPs / CIDR), business context, credentials if authenticated testing is needed, and an emergency contact.

Credentials, screenshots and evidence are encrypted at rest and used solely for the report. After delivery we sanitize or destroy data per agreement, and we can sign an NDA.

Scanners execute rules. The Gabala squad plans, decides, chains exploits and verifies every finding — with human experts supervising, correcting course and stepping in for advanced attacks. The report contains zero unverified “possible issues”.

Three things. Delivery model: firms sell man-days, Gabala charges by results — no verifiable finding, no fee. Firepower: one order fields a full squad of six AI attack roles plus a senior expert, running around the clock — coverage and depth a lone tester can't match. Quality: No PoC, No Finding — every finding ships with a proof of exploit, reproduction steps and expert review, ready to feed straight into remediation.

The AI squad handles the heavy, scaled execution: recon, scanning and exploit verification run around the clock. Security experts stay in the loop the whole time — supervising every AI decision, correcting misjudgments, and personally designing and executing advanced attacks when the AI hits its limit (complex WAF bypasses, logic-flaw exploitation, and the like). Every final finding is confirmed by an expert.

We test first and charge by results: if we find no verifiable vulnerability, you pay nothing. Offline payment is supported: bank transfer, Alipay or WeChat. After you submit an order, our team contacts you to finalize the agreement and payment.