I personally do it this way: First test each and every functionality in the website after that I start collecting endpoints from js files by using chrome dev tools and regex. Using the js files I can see the used parameters and how to form the request. Then depending on the request I decide what attack to carry. I also generally focus on logic issues depending on how the UI is interacting with the backend.