Penetration testing and offensive security audits
Keep your data inside your fortress
I'm Eliot Rabaud, a freelance penetration tester based in Montpellier, France, OSCP and BSCP certified. I attack your web applications, Active Directory and Azure cloud the way a real attacker would, then hand you a report your teams can act on.
Find your weaknesses before attackers do.
Start small, decide later
€500 excl. VAT · 1 day · free if an audit follows
External Discovery Audit
Not sure where to start? Dungeon Data maps what your company exposes on the Internet, tests the riskiest entry points and tells you which audit to run next.
See the offer2 minutes · €700/day excl. VAT
Estimate your audit online
Web application, Active Directory, Azure cloud: answer a few questions and get a detailed, line-by-line estimate you can adjust yourself.
Estimate my auditOffensive security
Four kinds of audit, depending on what you expose. In every case I test your real scope with attacker techniques, and every finding comes with proof and a fix.
Web application pentest
Building a SaaS or an API? I test authentication, cross-tenant access control, business logic and injections, following OWASP.
Details : Web application pentest
Active Directory pentest
Is one compromised laptop enough to become Domain Admin? I look for the paths ransomware operators would take through your internal network.
Details : Active Directory pentest
External security audit
What an attacker sees of you from the Internet: forgotten subdomains, VPN, email, exposed services, leaked credentials.
Details : External security audit
Azure cloud audit
Entra ID, Conditional Access, roles, managed identities, storage. I check that your Azure tenant does not leave a door open.
Details : Azure cloud auditAbout me
I'm Eliot Rabaud, founder of Dungeon Data. I've been a penetration tester for 7 years, specialised in web applications and Active Directory, and I also work on Azure cloud environments. I have run several hundred audits of applications and internal networks across Europe.
Outside client work I do bug bounty, teach cybersecurity in engineering schools and train teams on Azure architecture (AZ-305). It keeps me current, and it makes me good at explaining a vulnerability to people who are not security specialists.
My OSCP and BSCP certifications can be verified in one click.
My LinkedIn profile
Planning a security audit?
Estimate your audit online in 2 minutes, or book a call. You leave with a duration and price range, no strings attached.
Get a quoteAny questions?
How much does a penetration test cost?
Between €700 and €10,000 (excl. VAT) depending on the size and complexity of the scope. The price mostly depends on the number of testing days, which you can estimate yourself with the online quote tool, then refine on a scoping call. For perspective: according to an Asterès study published in June 2023, a successful cyberattack cost French organisations close to €59,000 on average in 2022.
What is in the report?
An executive summary (overall risk, priorities), then one entry per vulnerability: description, proof of exploitation, CVSS score, concrete impact and a recommended fix tailored to your stack. The report is delivered as a PDF and walked through with your team in a debrief meeting.
Do I need a security audit?
Yes if you expose an application or API, if a customer or tender asks for a pentest report, if you are preparing for ISO 27001 or SOC 2, or if your business falls under NIS2. Ransomware hits small companies too: an Active Directory and a mailbox are enough to be a target.
How long does an audit take?
Testing takes 1 to 10 days depending on the scope. Add scoping and the signed rules of engagement beforehand, then reporting and a debrief afterwards. During testing you are barely involved: a kick-off call, a reachable contact in case something goes wrong, and a debrief at the end.
Why hire a freelancer?
You talk directly to the person doing the testing, from quote to debrief, with no middleman. Recommendations fit your actual constraints, and you have someone to ask while you fix things. The price also reflects the absence of a consultancy’s overhead.
Are you PASSI qualified?
No. ANSSI’s PASSI qualification is required for the sensitive systems of French critical infrastructure operators and in some public tenders. For an SME, a SaaS vendor or a mid-size company dealing with NIS2, ISO 27001 or a customer security questionnaire, it is usually not required. If your context demands it, I will tell you on our first call.
Recent articles
Field notes on pentesting, Active Directory and cloud security.
- Pentest
GDPR and penetration testing
How penetration testing helps meet GDPR security obligations: the articles that matter (25, 32, 33, 35), the sanctions, and why a pentest…
- Pentest
Internal pentest: an audit from the ransomware perspective
Internal penetration testing from the ransomware angle: what it assesses in your network and Active Directory, how it runs, and which fixes…
- Pentest
Intrusion Audit
An intrusion audit (pentest) or penetration test is a mandatory phase when you want to secure your data. Whether the pentest is conducted…
Let's talk about your data security.
Location
Montpellier, France. Remote or on-site engagements across France and Europe.
Send a message
I reply within 1 to 2 business days.