Broken Object Level Authorization (BOLA) is a prevalent vulnerability in modern APIs and web applications, ranked as the top risk in the OWASP API top 10 and the fourth most reported vulnerability type in HackerOne Global Top 10. The consequences of BOLA can be severe, from sensitive data exposure to a total loss of system control. While manually verifying or triggering known BOLAs is typically straightforward, automatically identifying the correct execution sequences and generating viable input values for testing BOLAs is challenging. The complexities of application and business logic, the wide range of input parameters, and the stateful nature of modern web applications all hinder existing static analysis tools from detecting unknown BOLAs.To overcome these challenges, we leverage LLM's reasoning and generative capabilities to automate tasks that were previously done manually. These tasks include understanding application logic, uncovering endpoint dependency relationships, generating test cases, and interpreting test results. When combined with heuristics, this AI-backed method enables fully automated BOLA detection at scale. We dub this research BOLABuster. Although BOLABuster is still in its early stages, it has already discovered multiple new vulnerabilities in open-source projects.- We disclosed 15 CVEs in EasyAppoitments, with seven of them scoring 9.9 CVSS score, leading to critical privilege escalation.- We disclosed CVE-2024-22278, a BOLA vulnerability in Harbor, an open-source CNCF Graduated project with over 22,600 stars and 1.8 million downloads.- We disclosed CVE-2024-1313, a BOLA vulnerability in Grafana, an open-source project used by over 20 million usersWhen benchmarked against other state-of-the-art fuzzing tools using applications with known BOLAs, BOLABuster, on average, sends less than 1% of the API requests to a target server to uncover a BOLA.In this talk, we will share our methodology and the lessons learned from our research. We invite you to join us to learn about our journey with AI and explore a new approach to conducting vulnerability research.