This paper describes how it is possible to send data in TCP headers using the acknowledgment numbers.
You can download it from the following link: https://packetstormsecurity.com/files/download/29840/tcp.acknowledgement.txt
Source: https://packetstormsecurity.com/files/29840/tcp.acknowledgement.txt.html