Ahh, that era is long over. Even fast food workers get paid, and pen testing isn't as easy as flipping burgers.
You need training to do it nowadays, and a lot of it. Anyone doing it deserves a buck or thousand.
Most successful pen tests that get real data out of places are SQL injection attacks and attacks against reasonably well thought out authentication schemes. If you're learning enough to do an SQL injection attack, you definitely deserve to get paid, and paid well. Slogging through that sort of thing, sucks.
Here's a clue though: If your garbage man makes more money than your pen tester...