Resources
If you are still not solid on your understanding of subdomain takeover, the following resources should help get you up to speed:
- HackTricks - Domain/Subdomain Takeover
- Hackerone - Guide to Subdomain Takeovers
- OWASP Web Application Security Testing - Test for Subdomain Takeover
One this BadDNS doesn't help with very much is the actual takeover process, once a valid takeover is detected. This varies significantly from takeover-to-takeover. There are some excellent resources focused on the exploitation side of subdomain takeovers.
First and foremost, can-i-take-over-xyz. The issues pages within this GitHub repo contain most of the current research on individual takeovers.
Another excellent resource for some specific cloud provider based takeovers are the "GoDiego" blog posts, by @secfaults.