Attacking APIs using JSON injection