The author of sqlmap added DNS exfiltration for blind SQL injection last year. Really creative technique (DNS stack doubled the size of sqlmap code-base).
Paper: http://arxiv.org/pdf/1303.3047.pdf
Slides: http://www.slideshare.net/stamparm/dns-exfiltration-using-sq...