This may be slightly off-topic, but how do you get started in pen-testing? I read a book about it and the book, with focus on white-hat hacking, was very clear about making sure you have a green-lit target to test on, but even the company I work for isn't going to let me randomly hack away and test security without an agreement in place (they would want to know I was doing it so as to filter false positive attacks, for example).

So without doing anything either illegal or unethical, things that could lose me my current job, how does one build up the skills and experience?