He's not especially knowledgeable. He downloads his exploit scripts from Web sites and often barely understands what he's doing. This type of cracker is incredibly common on the Internet and, as I hope to show you below, is the bulk of the problem. Hardening your system is effective against all three classes of cracker, but we're going to discuss the Kiddie here, as he represents the simplest, yet most common, case that can be easily stopped. He can run a remote exploit against your system from some other host on the Internet, while he can only run a local exploit from an account on your system itself.
Remote exploits are far, far less common, but rather dangerous.
We'll consider this type first. Few exist and even fewer actually work, but he'll tend to find one or two that do work. His exploit only works against a small percentage of machines on the Internet, so he's got to scan a large portion of it to find vulnerable hosts. The kiddie can scan a large IP range in hours. He'll usually log off and let his scanner run, coming back for the listing of vulnerable machines later.