It can be done manually. Send the request to a server you control and check the logs. It doesn't scale well but it would work fine for a targeted attack.