// Capabilities.jsx — three pillars of a real pentest practice
const Capabilities = () => {
const rows = [
{
tag: 'Manual exploitation',
title: 'Real exploits, chained and reproduced',
body: 'Automated tools report individual issues. Our team combines them into the full attack path, reproduces it, and explains what it means for your business.',
bullets: ['Step-by-step exploit walkthroughs', 'Proofs of concept with cURL, payloads, and screenshots', 'Custom tooling where it is needed'],
visual: 'terminal',
},
{
tag: 'Coverage you can audit',
title: 'Every test case, documented',
body: 'We test against published standards (OWASP WSTG, ASVS, MASVS, API Top 10) and record every test case, including the ones that passed. Your auditors see exactly what was covered, and so do you.',
bullets: ['Checklist-mapped test execution', 'Tested, passed, vulnerable, or n/a for every item', 'Fully verifiable reporting'],
visual: 'scan',
},
{
tag: 'Reports engineers will fix',
title: 'Two reports for two audiences',
body: 'An executive summary for leadership and a technical report for the engineers doing the work. Severity reflects your environment, and every remediation is checked against your stack before we hand it over.',
bullets: ['Executive and technical reports for every engagement', 'CVSS, CWE, and MITRE ATT&CK mappings', 'Direct access to your tester throughout remediation'],
visual: 'map',
},
];
return (
Our approach
How we work
Manual testing, documented coverage, and reports your engineers can use.
{rows.map((r, i) => (
))}
);
};
const CapabilityRow = ({ tag, title, body, bullets, visual, flip }) => {
const useVP = window.useIsMobile || (() => false);
const isMobile = useVP(900);
return (
{/* Visual */}
{visual === 'scan' && }
{visual === 'terminal' && }
{visual === 'map' && }
{/* Copy */}
{tag}
{title}
{body}
{bullets.map(b => (
{b}
))}
);
};
// Coverage visual — checklist of OWASP test cases ticking in real time
const CoverageVisual = () => {
const [progress, setProgress] = React.useState(12);
React.useEffect(() => {
const t = setInterval(() => setProgress(p => p >= 142 ? 12 : p + 1), 240);
return () => clearInterval(t);
}, []);
const items = [
{ id: 'WSTG-INFO-02', t: 'Fingerprint Web Server' },
{ id: 'WSTG-CONF-04', t: 'File Extensions Handling' },
{ id: 'WSTG-IDNT-04', t: 'Account Enumeration' },
{ id: 'WSTG-ATHN-02', t: 'Default Credentials' },
{ id: 'WSTG-ATHN-04', t: 'Bypass Authentication' },
{ id: 'WSTG-ATHZ-02', t: 'Bypass Authorization' },
{ id: 'WSTG-SESS-03', t: 'Session Fixation' },
{ id: 'WSTG-INPV-05', t: 'SQL Injection' },
{ id: 'WSTG-INPV-11', t: 'Code Injection' },
{ id: 'WSTG-CRYP-04', t: 'Weak Encryption' },
{ id: 'WSTG-BUSL-09', t: 'Upload of Malicious Files' },
];
return (
OWASP WSTG · v4.2
{progress} / 142 cases
{items.map((it, i) => {
const tested = i * 13 + 6 < progress;
const flagged = it.id === 'WSTG-INPV-05' || it.id === 'WSTG-ATHZ-02';
return (
{it.id}
{it.t}
{tested && (
flagged
? VULN
:
)}
);
})}
);
};
// Terminal visual (kept) — more pentest-flavored commands
const TerminalVisual = () => (
{['#ff5f57', '#febc2e', '#28c840'].map(c => (
))}
operator@gs-pentest ~
);
// Report visual — animated severity distribution + finding cards
const ReportVisual = () => (
ACME Corp · External Pentest
GS-2026-0418 · 127 pages · v1.2
FINAL
{/* Stacked severity bar */}
Findings by severity
{[
{ l: 'Critical', n: 3, c: '#e8543a' },
{ l: 'High', n: 7, c: '#d98326' },
{ l: 'Medium', n: 13, c: '#5e6ad2' },
{ l: 'Low', n: 15, c: '#62666d' },
].map(s => (
))}
{/* Finding rows */}
{[
{ id: 'F-01', t: 'Jenkins CLI arbitrary file read → RCE', cvss: 9.8, sev: 'critical' },
{ id: 'F-02', t: 'Kerberoastable SPN with weak password', cvss: 8.4, sev: 'high' },
{ id: 'F-03', t: 'IDOR in /v2/orgs/{id}/members', cvss: 7.7, sev: 'high' },
{ id: 'F-04', t: 'Stored XSS in admin internal notes', cvss: 6.1, sev: 'medium' },
].map(f => (
))}
);
Object.assign(window, { Capabilities, CapabilityRow });