You can open the Developer tools in the web browser (Control + Shift + i) when you open the web mapping application. Click on the "Network" tab. You might have to reload the page after opening the tools. Then look through the calls that are made for something like 'export' or 'query' in the name column. hover your mouse over each to see the full URL.
The format should be something like https:<domain.com>/<server web adaptor>/rest/services/<folder>/<servicename> /MapServer
Copy the URL for the entry that looks like the service you are interested and paste it in a new tab. Remove everything after 'MapServer', then load the page. If they have not disabled the Rest Directory, you should see all the layers that are part of the service.