That's only true of a 24-bit subnet mask. In a 23-bit mask, 0 and 255 may well be perfectly valid.
Within any subnet, only the very first and very last (all zeroes, all ones) addresses cannot be used. Finding valid addresses without taking into account the subnet mask is quite impossible.