Easiest way to hack Drupal 6.22 installation for security audit I am doing a security audit for a client.  Their installation is Drupal 6.22.  I need to show them it's unsafe.  What is the easiest way to hack it as an example?

I would need to directly show them the steps, so it must be quite detailed instructions.  They have the following modules installed:


Administration menu
Color
Comment
Database logging
Help
PHP filter
Taxonomy
Update status
Masquerade
CKEditor
AES


Here are some common settings:


Server      Apache/2.2.3
MySQL database  5.0.77
PHP     5.2.17
update.php  Protected
File system Writable 
register_globals    Disabled
The question you're asking is pretty impossible to answer. If you know Drupal and/or web security then you'll know the answer already. If you don't then the answer is too long to put into a Stack Exchange comment.

Here are some articles about how I have gained knowledge of web application security and how I perform a security audit of a Drupal site:


How to become a Drupal security expert
Steps to a Drupal Security Review


I agree with Ivan Alfaro that the security_review module is a good start. Many of the elements that the security_review module audits can be audited from outside a site, so you could look at what it does and see if you can do similar things.