The paper How to cook a covert channel [Hakin9 Pdf] originally released in the hakin9 magazine describes step by step how to implement a few covert channel concepts over HTTP cookies :
   o Control communication channel
   o As stealth as possible (don't care about latency or bandwith)
   o Backdoor oriented

The paper finally describes a funny second level caching method allowing to use HTTP proxy servers as intermediaries to build a communication channel thus having a way to communicate with a third party without having to reach the remote server for each data packet.

Httpostng - is POC tool converting a text file into one or several png images and sending them to a remote CGI so that a detector has to figure if all POST images are legitimate or suspicious. [learn more]

Team member's sites: blog.0x557.org/icbm/