Once inside:

Applications often default to port 3000 during development or for specific dashboard services:

Port 3000 (TCP) – Common Web Application Port - PentestPad

HMR uses a WebSocket endpoint (usually /sockjs-node/info ). This endpoint is often misconfigured to accept commands from any origin.

React and Webpack generate source maps that end with .map . Use gobuster or ffuf to locate them: