How to locate the Entry Points of a Drupal 8 Core module? I'm to perform a security audit on the Drupal 8 Core modules, and was curious if there were any telltale signs of Entry Points (ie, how a module communicates with an external module and vice-versa). 

OWASP defines an Entry Point as "the interfaces through which potential attackers can interact with the application or supply it with data."

I assume this is not very different from Entry Points of standard web applications (forms, HTTP packets, etc.), but I am interested in knowing whether or not Drupal has its own standard as to where these Entry Points are located. Are there specific snippets of code I should be looking for?

I do intend on reviewing the modules manually and in-depth, but figured someone on here may have some advice to help lessen the steep learning curve. 

Any and all help is appreciated!

Cheers! :)
Entry points will equate to routes in Drupal.

Modules will normally define their routes in a YML file named MODULE_NAME.routing.yml, but routes can be defined programmatically as well, check out this article from Acquia about routes: 
 https://dev.acquia.com/blog/coding-drupal-8/defining-and-altering-routes-in-drupal-8/22/03/2016/9891

Also the 'routing' table in the database lists all the paths and their corresponding routes (I believe all).  Note the use of '%' and '{some_value}' to indicate dynamic route values.

Hope that gets you started.