Question: We're deploying a new website, hosted ourselves. Short of getting in white hats how would you go about penetration testing from outside the network?

Answer: 
Tools that I would use

[Nmap](http://nmap.org/) Sister Tool [SQLMap](http://sqlmap.sourceforge.net/doc/README.html)

and [Nessus](http://nessus.org/nessus/)

also quick scanning for XSS and HTML Injection <http://www.seoegghead.com/tools/scan-for-html-injection.seo> also <http://www.cirt.net/nikto2>

Make sure you have looked at this during your development [OWASP](http://www.owasp.org/index.php/Main_Page)

You need to also check the Security Guidence from MS
[Windows Server 2008 Security Guide](http://www.microsoft.com/downloads/details.aspx?FamilyID=fb8b981f-227c-4af6-a44b-b115696a80ac&displaylang=en)
Actually i'm the main creator of a new pentest LiveCD Distro, which is a fork of Backtrack 4.
The Distro embbeds everything needed to make good penetration tests ( OpenVAS, Metasploit, fasttrack, milw0rm exploits...). Its name is shadowcircle, and you can check it out @ 

www.shadowcircle.org.

Hope you'll like it ;)