Hunting for files

Dist folder

When you are able to see dist folder in the web application sitemap it usually means that the developer included all the package files instead only the .js ones.

Why is it important

Among these files there can be sample .html pages which can lead to Cross Site Scripting.

Exploitation

Search for developer's home page / github in order to identify files which will give us broader surface attack.

Package Enumeration

When we encounter "vendor" or "libraries" folders we can try to enumerate them using Gobuster and Seclists. That can uncover new vectors of attack.