- Social Engineering http://en.wikipedia.org/wiki/Social_engineering_(security)
- Intelligent Guessing/Estimating (This is why you don't use default passwords, names, etc)
- Knowledge of the system they are exploiting (version numbers and known exploits)
- Luck and Curiosity (hey, sometimes you just get lucky)
- then the 95% of the others are just Script Kiddies. http://en.wikipedia.org/wiki/Script_kiddie