The /web-console/ServerInfo.jsp and /status?full=true web pages often reveal server details.
You can expose management servlets via the following paths within JBoss (depending on the version): /admin-console, /jmx-console, /management, and /web-console. Default credentials are admin/admin. Upon gaining access, you can use available invoker servlets to interact with exposed MBeans:
You can enumerate and even exploit a JBOSS service using clusterd
Or using metasploit:
msf > use auxiliary/scanner/http/jboss_vulnscan
https://github.com/joaomatosf/jexboss
inurl:status EJInvokerServlet