The attack that requires no skill
A subdomain takeover doesn't require exploiting a vulnerability. No buffer overflow, injection or zero-day. The attacker looks at a DNS record, checks whether the resource it points to is unclaimed, and claims it. The subdomain now serves their content under the victim's trusted domain.
This has happened to Firefox, Shopify, and GitLab. To organizations with dedicated security teams and active bug bounty programs. The attack is trivially simple, and it keeps working because the misconfiguration that enables it is invisible until someone checks.
Firefox: trusted domain, attacker content
A subdomain under firefox.com had a CNAME record pointing to a hosting provider. The registration at that provider had lapsed. A security researcher claimed the resource and demonstrated that they could serve arbitrary content under the firefox.com domain.
