the script he was using wasn't a script used to try to get specific information. it's just a script to test if there are any invulnerablities he can take advantage of. so for that reason, we can't say what he wants.
he did compliment our security though and said it was "legit", so i'm guessing he didn't find any vulnerablities
if he did somehow find a vulnerablity.. he could destroy the entire databsae. at that point we would have to write a fix, and upload a backup of the database to get the website back up again.