Websites are basically just a program on a different computer somewhere. Think of it like passing notes back and forth.

User sends a note using their computer requesting the website content, that note gets passed to someone elses computer. That computer looks at the note and sends back a different note with some different information on it i.e. the website content. Then they keep sending notes back and forth as the user takes actions. The main two categories of “taking over a website” is to either catch the notes while they are being passed and change what it says (MITM attack) or to convince the other computer to send different notes to begin with.

But of course, the owners of the website have layers and layers and layers of protection to make it really hard to ‘convince’ their computer to do something unless you have all their special keys/passwords. That’s why you need to find some defect that lets you in anyways, or somehow get their keys/passwords.