1. Approaching domain owners directly
The best names I've ever bought I found by approaching the owners directly. FixItYourself.com and SepticSystem.com are 2 examples. Here's the story of a 3rd:
I recently decided that I wanted to buy a better domain name for my life insurance website. The old name was TermLifeOptions.com, and I felt like it detracted from the site's credibility. I generated a list of what I thought were the 20 best generic keyword names related to life insurance. (ie: Insurance.com, LifeInsurance.com, TermLife.com, InsurancePolicy.com, TermLifePolicy.com, etc.) I then checked each domain, and contacted all of the owners that hadn't built actual sites on their domain. Contacting the owner is often as simple as checking the record domain name at Whois.sc and sending an email to the administrative contact.
Given that life insurance is such a competitive niche, many of the names were unavailable. Prices on some of the available names were as high as $100,000. However, the owner of TermLifePolicy.com was willing to talk in a couple of months, if the deal he was working on at the time fell through. Luckily for me, it did, and we were able to agree on a price.
NameJet is a drop-catching service. That is, when a domain owner allows a domain to expire the name "drops", and a number of services (such as NameJet, Pool.com and SnapNames.com) compete to register the name and then resell it. However, NameJet also has exclusive relationships with a number of registrars that guarantees that Pool and SnapNames can't compete to catch names. That means that many of the best names are only available through NameJet. I've purchased 8 names through NameJet in the last 2 years, including RoofingEstimate.com, AccessRamp.com and a third excellent name that I'm not going to mention here.
The trick with NameJet, I think, is to be patient and selective. Spend 10 minutes every day checking the service, and don't buy names of marginal value. (For example, one of the 8 names I bought was xShoe.com -- what in the world was I thinking?) If you want to buy names of marginal value, I'd recommend a different method.
3. Buying names for Reg Fee
"Reg fee" means that you pay only the registration cost of a name -- somewhere around $7 - $8. The trick for buying names for reg fee is simply to generate a large number of names (either via scripts or just through keyword munging in Excel). Then run 10,000 names through a Bulk Registration tool (like GoDaddy's bulk reg tool).
The advantage of this approach is that you can develop a relatively large portfolio at low cost. I've sold three "reg fee" names in the past few months for between $300 - $450 apiece.
However, the disadvantage is that you may be paying reg fee on 200 names a year to sell 3 or 4 names. If you don't have a repeatable method of selling names, then you may have a hard time making a profit, even if you bought the names for cheap.
The trick for all three of these approaches is not to fall in love with a particular domain name. If you must own a particular name, you're going to pay a premium for it. If you simply need a good name in a particular vertical, you can generally find one that represents good value. (If you simply want a good commercial name, and you don't care what niche it's in you can probably get a steal!)