[Dyme]

Well there are multiple ways.

Human Error
Admin Stupidity
Incorrectly configured software
SQLi (Union Based, Error Based and Time Based)
XSS [Cross Site Scripting] (Persistent, Reflective and DOM-based)
CSRF {aka XSRF} [Cross Site Request Forgery]
LFI [Local File Inclusion]
RFI [Remote File Inclusion]
RCE [Remote Code Execution]
Arbitrary Code Execution
XPATH Injection
Local File Disclosure
Full Path Disclosure

Full path disclosure is my fav way to hack sites tbh. To simplify your answer for the OP, hackers often exploit vulnerabilities in a website's web application because of an error made by the programmer (compared to the lang itself). There are many more ways that a websites server can be compromised of course, but exploiting the web application is the most common method if we're talking about attacks on port 80 alone.

Insert link to OWASP and done.

Just remember that there always has to be a vulnerability in something, whether that be the admin's stupidity, the web application, or the DNS service.