OWASP's XSS Filter Evasion Cheatsheet has a Perl script listed:
perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
It also says this above it:
Null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy or use %00 in the URL string or if you want to write your own injection tool you can either use vim (^V^@ will produce a null) or the following program to generate it into a text file. Okay, I lied again, older versions of Opera (circa 7.11 on Windows) were vulnerable to one additional char 173 (the soft hypen control char). But the null char %00is much more useful and helped me bypass certain real world filters with a variation on this example:
Does this mean that you can't inject it straight into an
input? Or do you have to use Burp Suite or some other tool?