Look at what the platform opens, not just what you deploy
The app on :8080 is rarely the whole attack surface. Enumerate every listener the server itself owns.
Tag: tips
Match the gadget to the target library version
serialVersionUID mismatches quietly kill deserialization payloads. Here is how to stop guessing.
Grep your way to serialization sinks
A fast first pass for finding Java deserialization entry points before you open a debugger.