See section 4.3 in the Spectre paper - https://spectreattack.com/spectre.pdf

It includes an implementation of the exploit in a few lines of javascript.