https://greyshell.github.io/posts/demystify_java_gadget_chain/
Demystify a Java gadget chain to exploit insecure deserialization - Greyshell's Diary