Easiest way to hack Drupal 6.22 installation for security audit
The question you're asking is pretty impossible to answer. If you know Drupal and/or web security then you'll know the answer already. If you don't then the answer is too long to put into a Stack Exchange comment.

Here are some articles about how I have gained knowledge of web application security and how I perform a security audit of a Drupal site:


How to become a Drupal security expert
Steps to a Drupal Security Review


I agree with Ivan Alfaro that the security_review module is a good start. Many of the elements that the security_review module audits can be audited from outside a site, so you could look at what it does and see if you can do similar things.