The paper How to cook a covert channel [Hakin9 Pdf] originally released in the hakin9 magazine describes step by step how to implement a few covert channel concepts over HTTP cookies :
   o Control communication channel
   o As stealth as possible (don't care about latency or bandwith)
   o Backdoor oriented

The paper finally describes a funny second level caching method allowing to use HTTP proxy servers as intermediaries to build a communication channel thus having a way to communicate with a third party without having to reach the remote server for each data packet.

CCTDE - is a first implementation of the Gray-World.net Covert Channel and Tunneling over the HTTP protocol Detection : GW implementation theoretical design' paper.
[learn more]

Team member's sites: blog.0x557.org/icbm/