The paper How to cook a covert channel [Hakin9 Pdf] originally released in the hakin9 magazine describes step by step how to implement a few covert channel concepts over HTTP cookies :
   o Control communication channel
   o As stealth as possible (don't care about latency or bandwith)
   o Backdoor oriented

The paper finally describes a funny second level caching method allowing to use HTTP proxy servers as intermediaries to build a communication channel thus having a way to communicate with a third party without having to reach the remote server for each data packet.

CCTT, "Covert Channel Tunneling Tool" - is a C tool presenting several exploitation techniques allowing the creation of arbitrary data transfer channels in the data streams authorized by a network access control system.
[learn more]

Team member's sites: www.infosecwriters.com/ hhworld/ The Hitchhiker's World e-zine