[PEN-TEST] Hypothetical Wargaming

[H Carvey <keydet89 () YAHOO COM>]

Assume you're given a pen test.  All you have is a 
domain name.  A couple of quick checks tell you 
that the systems in question are Win32 machines.

Your goal is to "tag" a file.  No DoS allowed.

IIS, Exchange, and MS DNS are being used.  

What steps do you take?  At each step, what do you 
hope to gain, and what programs/scripts/techniques 
do you use (give program name, and command line 
switches/GUI options)?

At each step, assume both NT and Win2K.