[xornull]

I've wondered about the various methods that websites are hacked, I know there's SQL Injection there which is probably the most basic one, I've read a bit about XSS but it is still not clear to me how everything really fits together.

[Crypt]

SSI injection, CSRF vulnerabilities, LFI, RFI, RCE, authentication bypass, XML injection, arbitrary file handling, CRLF injection, LDAP injection, XPATH injection, directory traversal, path disclosure...

The list goes on.

[Shebang]

I'll admit I don't know much about website hacking, but two other methods (I could totally be using the wrong terms here) are Local and Remote File Inclusion (LFI and RFI). From the Wiki page for RFI:

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file or more serious events such as:

• Code execution on the web server
  
• Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
  
• Denial of Service (DoS)
  
• Data Theft/Manipulation

[tortilla]

There are two main ways to do it:
- Attack on web application, here you use things like:
- SQLi
- CSRF
- ...
- Attack the webserver - you exploit one of deamons running here, or guess password, etc...

[BreShiE]

Well there are multiple ways.

Human Error
Admin Stupidity
Incorrectly configured software
SQLi (Union Based, Error Based and Time Based)
XSS [Cross Site Scripting] (Persistent, Reflective and DOM-based)
CSRF {aka XSRF} [Cross Site Request Forgery]
LFI [Local File Inclusion]
RFI [Remote File Inclusion]
RCE [Remote Code Execution]
Arbitrary Code Execution
XPATH Injection
Local File Disclosure
Full Path Disclosure

These are very well knows but then you also have new vulnerabilities coming such as the Heartbleed bug.

Now I havent even scratched the surface of the different techniques and vulnerabilities out there, but this should hopefully give you somewhere to start. There's a few others I was going to mention but forgot the names of them.

[Crypt]

There are two main ways to do it:
...
- Attack the webserver - you exploit one of deamons running here, or guess password, etc...

He asked how a website was hacked.

Not the server.

[BreShiE]

SSI injection, CSRF vulnerabilities, LFI, RFI, RCE, authentication bypass, XML injection, arbitrary file handling, CRLF injection, LDAP injection, XPATH injection...

The list goes on.

This basically clears up the rest of my list.

[tortilla]

He asked how a website was hacked.

Not the server.

And there is no chance that you could do things like get and edit database, deface webpages and so on when you have access to server where they are hosted?

[Crypt]

And there is no chance that you could do things like get and edit database, deface webpages and so on when you have access to server where they are hosted?

You can, but that's not hacking the website itself. He's talking about hacking a website directly. Not getting server access somehow then doing something to the website with full authentication.

[tortilla]

You can, but that's not hacking the website itself. He's talking about hacking a website directly. Not getting server access somehow then doing something to the website with full authentication.

Ah, then I guess I misunderstood. Sorry man.