The big wins on external network penetration testing are rarely exotic zero-days. They are the forgotten box, the unpatched VPN, and the login that still says admin/admin. Here is what we find, and how.