- [Social Engineering][1]
- Intelligent Guessing/Estimating (This is why you don't use default passwords, names, etc)
- Knowledge of the system they are exploiting (version numbers and known exploits, previous employment, or previous experience)
- Luck and Curiosity (hey, sometimes you just get lucky)
- then the 95% of the others are just [Script Kiddies][2]. 

[1]: http://en.wikipedia.org/wiki/Social_engineering_(security)
[2]: http://en.wikipedia.org/wiki/Script_kiddie