A service uses a selector to identify the list of pods to proxy to (if they're in the Ready state). You could simply ask for the same list of pods with a GET request:

$ curl -G "$MASTER/api/v1/namespaces/$NAMESPACE/pods?labelSelector=$KEY=$VALUE"

And then manually send your request to each of the pod ip:port endpoints. If you need to be able to send the request from outside the cluster network, you could create a proxy pod (exposed to the external network through the standard means). The proxy pod could watch for pods with your label (similar to above), and forward any requests it receives to the list of ready pods.

A similar effect could be achieved using hostPort and forwarding to nodes, but the use of hostPort is discourage (see best practices).

Here's a method that works as long as you can send the requests from a container inside the k8s network (this may not match the OP's desire exactly, but I'm guessing this may work for someone googling this).

You have to look up the pods somehow. Here I'm finding all pods in the staging namespace with the label app=hot-app:

kubectl get pods -l app=hot-app -n staging -o json | jq -r '.items[].status.podIP'

this example uses the awesome jq tool to parse the resulting json and grab the pod ips, but you can parse the json in other ways, including with kubectl itself.

this returns something like this:

10.245.4.253
10.245.21.143

you can find the internal port like this (example has just one container, so one unique port):

kubectl get pods -l app=hot-app -n staging -o json | jq -r '.items[].spec.containers[].ports[].containerPort' | sort | uniq
8080

then you get inside a container in your k8s cluster with curl, combine the ips and port from the previous commands, and hit the pods like this:

curl 10.245.4.253:8080/hot-path
curl 10.245.21.143:8080/hot-path