Which folders/files in drupal 6 need not executive permission? In order to tighten security of D6 against malicious XSS file uploads, I am wondering what files and folders can have go-x permission where the group is webserver.
All folders need +x perhaps you're referring to +w ? In which case, only the files folder e.g in /sites/default/files needs to be +w by the webserver. All other folders can be owned and writeable by root only.

Here's some find commands to recursively chmod the file/folder permissions correctly

;Change all directories to 755 (-rwxr-xr-x):
find /var/www/mysite -type d -exec chmod 755 {} \;

;Change all files to 644 (-rw-r--r--):
find /var/www/mysite -type f -exec chmod 644 {} \;

;Change ownership of files directory and files to webserver user, e.g www-data
chown -R www-data:www-data sites/default/files


Update: example nginx conf to disallow .php file access in the files directory:

# Do not attempt to serve php files within sites/default/files
location ~* ^/sites/default/files/.*\.php$ {
    return 404;
}