An interesting HTTP injection rootkit
lwn.net