Subdomain takeover

When it applies

A subdomain's DNS still points (CNAME/A) to a third-party service that no longer has the resource provisioned, so you can register it and serve content on the victim's subdomain.

Why it works

The org deleted the S3 bucket / GitHub Pages / Heroku app but left the DNS record. The provider now serves that hostname to whoever claims the resource next — you. You control content on a trusted subdomain (phishing, cookie theft on the parent domain, OAuth redirect_uri allowlist).