If the playground loads, run introspection queries to dump the entire schema:

: Tools like dirsearch or gobuster can uncover hidden endpoints like /admin , /users , or /api . 3. Exploitation Vectors

Access: http://<target-ip>:3000/tree

# Open Chrome and navigate to chrome://inspect # Add network target: <target-ip>:3000