Error in MS SQL payload when using --count

[kobyan]

When fetching number of entries for table in Boolean Based SQLi in MS SQL
with --count:

[16:03:47] [PAYLOAD] 15536 AND UNICODE(SUBSTRING((SELECT COUNT(*) FROM <table>),1,1))>51

with --dump:

[16:10:20] [PAYLOAD] 15536 AND UNICODE(SUBSTRING((SELECT LTRIM(STR(COUNT(*))) FROM <table>),1,1))>51

As you can see, there is no conversion to string and trimming in --count payload, so it will throw an error when you try to SUBSTRING an int

[stamparm]

it doesn't make sense. i am not able to reproduce it - though, running on MySQL COUNT(*) is properly null-casted (i.e. checking for NULL and casted to string)

are you using --no-cast or smth?

[stamparm]

NOTE: for my future self: agent.py:493-504

[kobyan]

it doesn't make sense. i am not able to reproduce it - though, running on MySQL COUNT(*) is properly null-casted (i.e. checking for NULL and casted to string)

are you using --no-cast or smth?

Yes, I use --no-cast.