Question: We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

Answer: 
The first thing would be a **network scan**. Since you're on the windows stack, use [zenmap](http://nmap.org/zenmap/) and scan the webserver and both sql servers. This will tell you about open ports and services running. Run zenmap on the comprehensive test. I would use this info to tweak your firewall to block ports that are exposed. 

Another thing you would want to do is look for **SQL Injection vulnerabilities**. 

> 
> [Scrawlr](http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2008/06/23/finding-sql-injection-with-scrawlr.aspx) is a free software for
>  scanning SQL injection vulnerabilities
>  on your web applications.
> 
> 
> It is developed by HP Web Security
>  Research Group in coordination with
>  Microsoft Security Response Center.
> 
> 
> 

Check out this [ScreenToaster video](http://www.screentoaster.com/watch/stUE9XS0RIR11eSFxVX1peVlZR) that I created. It demonstrates a simple network scan for sql server, port 1433, and a basic SQL Injection.
Actually i'm the main creator of a new pentest LiveCD Distro, which is a fork of Backtrack 4.
The Distro embbeds everything needed to make good penetration tests ( OpenVAS, Metasploit, fasttrack, milw0rm exploits...). Its name is shadowcircle, and you can check it out @ 

www.shadowcircle.org.

Hope you'll like it ;)