The paper How to cook a covert channel [Hakin9 Pdf] originally released in the hakin9 magazine describes step by step how to implement a few covert channel concepts over HTTP cookies :
   o Control communication channel
   o As stealth as possible (don't care about latency or bandwith)
   o Backdoor oriented

The paper finally describes a funny second level caching method allowing to use HTTP proxy servers as intermediaries to build a communication channel thus having a way to communicate with a third party without having to reach the remote server for each data packet.

Paper : A Forensic Analysis : HTTP Protocol.
[read]

Team member's sites: blog.0x557.org/icbm/