Look at what the platform opens, not just what you deploy

Most testers point their tools at the web app and stop. But an application server opens ports and speaks protocols that have nothing to do with your deployment — naming services, management interfaces, legacy RPC.

nmap -sV -p- --open target
# then ask: which of these does the *platform* own,
# and which speak a protocol older than the web team?

Every extra listener is a door. The interesting ones are usually the doors people forgot were in the building.