Grep your way to serialization sinks

When you land on an unfamiliar Java codebase, the fastest way to find where attacker bytes become live objects is to grep for the readers, not the writers.

grep -rEn "readObject|readExternal|readUnshared|ObjectInputStream|XMLDecoder|readValue(" 
  --include="*.java" .

Then narrow to methods whose parameters are typed Object, Serializable, or Externalizable and cross a network boundary. Those are the pipes. Everything else is downstream.

The trick is ordering: note where the read happens relative to any authenticate() call in the same method. A read that runs before the auth check is the whole bug in one line.