Question: We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

Answer: 
Tools that I would use

[Nmap](http://nmap.org/) Sister Tool [SQLMap](http://sqlmap.sourceforge.net/doc/README.html)

and [Nessus](http://nessus.org/nessus/)

also quick scanning for XSS and HTML Injection <http://www.seoegghead.com/tools/scan-for-html-injection.seo> also <http://www.cirt.net/nikto2>

Make sure you have looked at this during your development [OWASP](http://www.owasp.org/index.php/Main_Page)

You need to also check the Security Guidence from MS
[Windows Server 2008 Security Guide](http://www.microsoft.com/downloads/details.aspx?FamilyID=fb8b981f-227c-4af6-a44b-b115696a80ac&displaylang=en)
[Nikto](http://www.cirt.net/nikto2 "Nikto") is a nice start to look for well known vulnerabilities. Works on Windows and Linux, etc. Simple enough even for noobs like me :)