I know from experience that JSON and XML are two of the most widely used formats for serializing data on the web, but how can I prove a statement like that?
You can't*. That's why you typically do not matter-of-fact-ly state that this is the case. You argue why you have chosen that you have selected those two formats, without claiming anything you are not sure about. For instance, it would be ok to claim that you have selected XML because it is used in many open standards, or that you have selected JSON because of its high compatibility to JavaScript, or that you have any of those because it is used in framework XY, which is of high significance to your work.
Loosely-related-story time:
I did my PhD in services computing. In my research circles, everybody "knew" that, while SOAP (a protocol for Web services) supports any number of protocol bindings (HTTP, TCP, JMS, even SMTP), the only binding that is really used is HTTP. We "knew" this because basically all tutorials and books really only talked about HTTP, and it seemed like a logical thing to do (you know, "Web" services and all). That was until I talked to a practitioner from IBM about this, who then informed me that more 70% of their's and their customer's SOAP services are actually consumed over JMS, because, even though this is much more annoying to set up, JMS is what most companies used for integration before Web services, and changing it would be way to intrusive.
End of story time
Especially for young software-developers-turned-computer-scientists, separating what you think is true (e.g., because many books or blogs claim it is, or because it seems logical) from what you know is true (e.g., because there are reliable studies, or because it can indeed be proven) is a hard, but valuable, lesson, and your undergraduate thesis is the perfect place to learn it. While writing your thesis, reflect what you really know and what is just the kind of "community common knowledge" that any community of enthusiastic practitioners tends to build up. Most of the time, the common knowledge will be correct, but you will be surprised about the times it isn't.
*And I am not 100% sure the statement is true. I would not be surprised if binary serialization (e.g., protocol buffers) is used more often than either, especially if the same entity controls both sides of the communication.