You can value a website one of two ways. You can value it purely based on traffic and or PageRank and how much money you think you can make with those statistics. This method is something of a gamble unless you truly know what you're doing since it relies on your judgement as to the site's potential. The other method is to value it based on income. A typical formula for the worth of a business is 2(net_yearly_profits) + value_of_assets. So you'd figure out how much the domain, software, and content of the site is worth, and then add that to monthly profit x24 or yearly profit x2.
In reality you'll probably use a combination of potential and profits to value any site you plan to purchase. One thing I can say is that you should be wary of any site that has a 0 for PageRank, visitors, or profits.
Websites are sold in a variety of places. On webmaster forums, on Ebay and other auction sites, or on specialized marketplace sites dedicated to the buying and selling of businesses.
Webmaster forums are your best bet for buying a website. The sites are typically worth buying and they are rarely lemons (and if they are it'll likely be pointed out by the forum members). The only downside is that you usually don't have as large of a selection on any particular forum.
Ebay is another good choice, as the websites typically are not overpriced, however 99% of all ebay website listings are lemons. They're either using stolen content and or designs, or they're simply cookie cutter sites that some company churns out. Ebay is where you'll get the most use out of Alexa and The Google Toolbar.
Specialized marketplace sites are in my opinion the worst source. Fraud isn't as common on these sites, unfortunately neither is realistic pricing. People will ask for tens or hundreds of thousands of dollars for sites with almost 0 traffic and 0 revenue. Basically they're hoping that there is atleast one sucker out there whole pay these extremely high prices and then they'll be set financially for awhile.