WRITEUP SPECTRE 2026
33 challenges with 35 published solutions between them. The writeups for this event were found in public repositories. Each link is pinned to the commit it was read from.
Where these writeups liveUncategorised10
The upstream scoreboard did not say, so neither do we.
0p3r4t10n L0ckd0wn
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Backup to the root
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Badge
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Checker
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Entrypoint
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Find your rights
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Ghost In The ENV
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Lecteur
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Socket Intro
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
The Quest Microbit
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Cryptography7
Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.
Server
3 official solutionsAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026, Labo-RT/WRITEUP-SPECTRE-7-2026, Labo-RT/WRITEUP-SPECTRE-7-2026
Chiffrement Xor
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Cisco Pass Faible
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Client Exemple
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Code Source
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Ecoute Chiffrer
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Result Client
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Web6
Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.
Access cookie
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Also written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
R0b0ts
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Renseignement
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
SQL Analyser
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Upload Php
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Misc3
Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.
Dirty Network Secrets
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Exfiltration Dns
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Transfert Chiffrer
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
OSINT3
Answer a question about the real world from public sources. The work is pivoting between identifiers, not exploiting anything.
Hacktivistes 1
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Journal Des Alpes
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Membre negligent
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Forensics3
Recover something from a file, a capture, or a disk image - often from a part of it the format says is unused.
P0st Fishing
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Soc Log1
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Soc Log2
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026
Binary exploitation1
Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.
Pay2win
1 official solutionAlso written up in: Labo-RT/WRITEUP-SPECTRE-7-2026