YAH

Java Serialization: A Practical Exploitation Guide

https://www.rapid7.com/research/report/exploiting-jsos/