See video writeup here:
https://www.youtube.com/watch?v=49FCrTSmbXQ

Solution:
Leak a timestamp via multipart boundaries