If there's nothing else, bruteforce
Well, script kiddies are not really clever, and they follow roughly these procedures:
1) Scan host for vulnerabilities, using a tool like SSS, etc. Use of stealth scanning techniques, as well as slow scan via multiple hosts,bouncing, innocent connections with great time gaps... well, all of this is too much to our little skiddies.. However, a skilled attacker will be much harder to notice. I am glad most of them aren't exactly skilled. You may notice several connections being attempted, to different ports. Packets with strange flags, and stuff like that. A good firewall can catch them for you, and having an IDS will make you aware of scanning attempts.
2) Funny part: tons of them now start asking in foruns, irc channels, icq, and wherever they can: "I scanned xxx.xxx.xxx.xxx , and I got these results.. what do I do next?" *Sigh*. After downloading the exploit, some of them might need help to compile it.
3) Ok, they managed to compile the damn exploit. A good part of them are shellcodes which explore buffer overflows. Very large strings, followed by code and a /bin/sh. Even when compiled, you may use the program strings to get the /bin/sh string, and this can also be caught by an IDS. Encrypted shellcodes are a problem, however. But it is in a more sophisticated level, since the kiddies don't write their own exploits.
Sure, all of you have already dissecated scan, exploits, impersonation attacks, sniffing.. very well, I must say. Just to add something, there are 2 things that have been quite "fashionable": PHP and lots of cgi attacks, and when nothing else works (or even as the first thing), bruteforce cracking. Several message boards have been attacked through some PHP bug.. :/
Just how easy it will be to spot the attack will depend on attackers skills, of course. I personally think I would be scratching my head quite often while looking at logs.. and perhaps drinking a lot of coffe.. hehe
