Finding Your First Bug: Reading JSON and XML for Information Disclosure