The paper How to cook a covert channel [Hakin9 Pdf] originally released in the hakin9 magazine describes step by step how to implement a few covert channel concepts over HTTP cookies :
   o Control communication channel
   o As stealth as possible (don't care about latency or bandwith)
   o Backdoor oriented

The paper finally describes a funny second level caching method allowing to use HTTP proxy servers as intermediaries to build a communication channel thus having a way to communicate with a third party without having to reach the remote server for each data packet.

Active port forwarder - uses SSL for secure packet tunneling. It is designed for people without an external IP who want to make some services available on the Internet.
[learn more]

Team member's sites: blog.0x557.org/icbm/