how can you check if a web application (as the attacker) has known vulnerabilities in it without already having exploited the application successfully?
There are various ways of fingerprinting a web application without having privileged access.
A common way to start is by identifying the versions of used libraries, frameworks and their respective plugins. This can be done by inspecting the source code, headers, guessing paths of readme files, etc. You'd then check if these versions are up-to-date or if there are any published vulnerabilities for them on the web.
As an example, take Facebook's blog
https://newsroom.fb.com/. By looking through the source code, you'll quickly find strings indicating that they're using Wordpress, e.g.:
<meta name="generator" content="WordPress.com" />
Knowing that they employ Wordpress you may want to look for popular plugins that are known to be vulnerable. E.g., they seem to be using the AMP plugin, because there is a
This readme reveals that they use the latest version
0.5.1, so the plugin seems up-to-date.
Another example would be
https://stackoverflow.com where you can discover which version of jQuery they use:
1.12.4 isn't the latest version, there don't seem to be any immediately exploitable flaws.
As you can see, checking an application for known vulnerable components doesn't necessarily require privileged access since versions and configurations are often leaked.