Extracting Multiple Bits per Request from Full-Blind SQL Injection Vulns (howto.hackallthethings.com)

You guys are absolutely crushing it. Would have never thought to use the response time from a server to be able to extract extra bits of information.

Keep up the awesome work and I look forward to seeing more research.