Text this: Toward discovering and exploiting private server-side Web API