Enviar por SMS: Sniping at web applications to discover input-handling vulnerabilities