Maybe local computer repair/sales shops? The correct batteries are expensive, many/most people just toss the old working UPS and buy a new one. Repair shops toss them often, sometimes e-bay them maybe.
If near a decent sized city, watch for auctions that may have such things. If an ISP goes under, they probably had one or more rack mounts maybe. Unless a dealer shows up, how many people really want such things? My favorite ISP went under awhile back, got hacked 2 twice, but they kept all the hardware.
Many types of businesses use various types of UPSs. Watch for places being sold out, going under. If a large grocery store goes under and the office equipment is being auctioned with store stock, there could be a great UPS in there. Watch for those type auctions, businesses that would demand the computers stay running for awhile durring a power outage.
Watch E-bay for used ones without batteries near you or someplace you want to go anyway and pick it up. Shipping can be high. The $560 Matrix 5000 I bought in Ohio would have cost me $300 for shipping. 800 mile drive, but I go near there anyway. So I drove up and got it free pickup. Same time on Ebay I found a 2200 rack mount UPS selling for $20 and $200 shipping, I bought it for $20 and free pickup, it was near the Matrix so no big deal.
I got the $5 UPS's as non-working for parts when I picked up the 2200.
It was a nice drive up and turned into a mini vacation, I even got to visit with Ghurd on the trip.
The deals are there you got to watch for them and be flexable. I just bought another Matrix 5000 in Chicago for $180. A friend is picking that one up and storing it for me till I go visit soon, so again no shipping which may have been near $300.
Actaully for the first testings any UPS should give you an idea. Most "SMART" Ups's are sinewave. But for experimenting even a modwave should be fine and more easy to find cheap or free since most average people probably have those wal-mart cheapies.
Since your looking for a way to bypass the DC/DC converter and drive the inverter from direct high DC volts any working UPS you find cheap or free should be good for testing, even a 200watt modwave if found free. Once you figure out the small ones I am geussing the larger ones will be about the same plus you will be less likely to fry the bigger ones knowing more about the little ones already.
Oh, and if I were doing this and made a mistake, I think I would rather be Zapped by 120Vac at 200watts than 120Vac at 3,000 watts. Probably an optional illusion but it just seems like 200watts would be less serious, though either could kill you I'm pretty sure.
I don't plan to do this myself. Agian, if you don't know much about what your doing then don't do it. Large ZAPS may not be fun, they could kill you or ruin your life.
I had a friend I don't see often these days. He was in electronics repair and great health. Then one day I went to visit and he has the shakes super bad. He did not say, I did not ask, but I am pretty sure he took a high voltage hit. Probably fried nerves or something.
How he feeds himself I don't know, with his shakes it would be like trying to eat on a roller coaster. We are still friends of course, reason I seldom see him now is he can't drive anymore so he never comes here now. Needless to say he no longer rides a motorcycle or does electronic repairs either. Great guy only about 40 years old. Probably touched the wrong thing at the wrong time