Null chars also work as XSS vectors but not like above, you need to inject them directly using something like Burp Proxy or use %00 in the URL string or if you want to write your own injection tool ...

privacy-protection-tools / anti-AD Public Notifications You must be signed in to change notification settings Fork 787 Star 10.5k ...