How do I find a short in an unpopulated 4-layer PCB?
Try the poor man's IR camera: Spray the board with cooling spray so you have the whole thing covered with tiny white ice crystals. Then run a high current through the short (plane to plane). Often you can see a spot melting where the short is - assuming the short has higher resistance than the planes (very likely).

Higher resistance => more heat (P = U*I = R*I^2).

No cooling spray in the lab? Turn the air spray can upside down - what comes out is also very cold.