BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsideslv24//speaker//UPDBGC
BEGIN:VTIMEZONE
TZID:America/Los_Angeles
BEGIN:DAYLIGHT
DTSTART:20230808T000000
TZNAME:PDT
TZOFFSETFROM:-0700
TZOFFSETTO:-0700
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20231105T020000
RDATE:20241103T020000
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20240310T030000
RDATE:20250309T030000
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:BOLABuster: Harnessing LLMs for Automating BOLA Detection - Jay Ch
 en\, Ravid Mazon
DTSTART;TZID=America/Los_Angeles:20240807T103000
DTEND;TZID=America/Los_Angeles:20240807T111500
DTSTAMP:20261009T012525Z
UID:pretalx-bsideslv24-FSYWPG@pretalx.com
DESCRIPTION:BOLA poses severe threats to modern APIs and web applications.
  It's considered the top risk by OWASP API and a regularly reported vulner
 ability on HackerOne Top10. However\, automatically identifying BOLAs is c
 hallenging due to application complexity\, wide range of input parameters
 \, and the stateful nature of modern web applications. \n\nTo overcome the
 se issues\, we leverage LLM's reasoning and generative capabilities to aut
 omate tasks\, such as understanding application logic\, revealing endpoint
  dependencies\, generating test cases\, and interpreting results. This AI-
 backed method\, coupled with heuristics\, enables full-scale automated BOL
 A detection. We dub this research BOLABuster.\n\nDespite being in its earl
 y stages\, BOLABuster has exposed multiple vulnerabilities in open-source 
 projects. Notably\, we submitted 15 CVEs for a single project\, leading to
  critical privilege escalation. Our latest disclosed vulnerability\, CVE-2
 024-1313\, was a BOLA vulnerability in Grafana\, an open-source platform w
 ith over 20 million users. When benchmarked against other state-of-the-art
  fuzzing tools\, BOLABuster sends less than 1% of the API requests to dete
 ct a BOLA. \n\nIn this talk\, we'll share the methodology and lessons from
  our research. Join us to learn about our AI journey and explore a novel a
 pproach to vulnerability research.
LOCATION:Florentine A
URL:https://pretalx.com/bsideslv24/talk/FSYWPG/
END:VEVENT
END:VCALENDAR