Pretty much the same way you approach any kind of legacy code. You find a piece that's testable, you write tests for it, and refactor.
If you can't find a piece readily testable, you'll need to make it testable without the safety harness of a test suite, in which case you very carefully change some almost-testable piece of code so that it is testable.
Code that doesn't render things to the browser - "infrastructure" code, models, database-touching stuff - might be a good place to start.
Edit: UI testing: With the warning that I have little experience here, a friend of mine does this: he runs some piece of HTML-generating code. Then he hacks on his code, and compares the newly-generated code against the old version (using diff; he hasn't automated all the way). Changes in the HTML means your refactoring broke.