Of course they do. Just be sure to go with one that isn't shady and has real people vouching for it like Chearful's site.
A web application can have access to the same resources and apis that a command-line script that runs on a server somewhere has.
From a technical perspective, all a sniper is really doing is making a few HTTP web requests programmatically. One to login to the Mojang site and grab the necessary tokens and another to send a POST request with the correct payload to the username change endpoint. The tricky part comes down to timing.
