Finding vulnerabilities in WAP-based mobile apps