The applications could call the methods using an HTTP GET request. In this case, you will see when an external resource will be called in the HTTP proxy. It is important to pay attention to the information sent by the HTTP headers, because all of the parameters sent in the request could be used by the method, for example:

https://www.mysocialnetwork.com/process.php?from=rick&to=morty&credits=10008000

In this URL, we can see that the application is sending all of the parameters directly. So, we do not need any additional parameters; the important thing is to execute the request. To do that, the most common method is to include the request in an <img> tag without the user knowing it, for example, in an external website:

<img src=" https://www.mysocialnetwork.com/process.php?from=rick&to=morty&credits=10008000">

The result is that when the <img> tag is parsed by the browser, the request is made, and the attack is executed. You can use other tags, even JavaScript.