Create two test accounts: User A and User B. Log in as User A. Using User A's token, try to access User B's objects — their orders, profile, documents, whatever your API exposes.

Every successful response is a BOLA vulnerability. The correct behavior is a 404 for every attempt. This test should be automated and run on every deployment.

Standard tests log in as User A and check that User A can see User A's data. That passes whether or not BOLA exists. You only find BOLA when you test User A trying to see User B's data. Most test suites never do this.

Burp Suite's Autorize extension automates this — it replays every request with a different user's token and flags anything that returns data it shouldn't. OWASP ZAP has similar capabilities. Even a simple script that swaps tokens between two sessions catches most BOLA issues.

Testing finds existing gaps — it doesn't prevent future ones. New endpoints need new tests. Testing without MIT 01 just documents the problem without solving it.