Modern SPAs (React, Vue, Angular) often ship all routes to the client. Use LinkFinder or JSFScan :
Some admins block non-browser user agents. But they allow Googlebot. User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html) how to find admin panel of a website
(Highly Effective, but requires ethical discipline) Modern SPAs (React, Vue, Angular) often ship all
Use curl -I https://target.com/ or Burp Suite Repeater. Look for: Modern SPAs (React
Using advanced search operators is arguably the most elegant technique.
for path in admin login wp-admin administrator dashboard cp; do curl -s -o /dev/null -w "%http_code $path\n" https://target.com/$path; done