Common ways I know of defacing a site:

1. Cross site scripting

2. SQL injection

3. Weak input validation

4. Weak permissions

5. Weak passwords

6. Server configuration/poorly updated software

The list goes on and on