You can do it using REPLICATE() and STUFF() as:

DECLARE @String VARCHAR(20)='TEST123456',
        @Start INT = 3,
        @End INT = 5;

SELECT
    @String AS MyString,
    STUFF(@String, @Start, @End - @Start, REPLICATE('*', @End - @Start)) AS Mask;

While you say "I don't know how long will be the string", the REPLICATE() function will return stars "*" accourding to the @Start and @End you provide.

You may try something like this

DECLARE @Str VARCHAR(20)='TEST123456',
    @x INT = 3,
    @Y INT = 9

SELECT
    MyString = @Str,
    Mask = STUFF(@Str,@x,@Y-@x,'********')

Output

MyString    Mask
TEST123456  TE********56

Use a combination of STUFF , REPLICATE and CHARINDEX .

DECLARE @string VARCHAR(20) = 'TEST123456'

DECLARE @maskStart CHAR = 'S'
DECLARE @maskEnd CHAR = '4'

SELECT
    Original = @string,
    MaskStartIndex = CHARINDEX(@maskStart, @string),
    MaskEndIndex = CHARINDEX(@maskEnd, @string),
    MaskToSet = REPLICATE('*', CHARINDEX(@maskEnd, @string) - CHARINDEX(@maskStart, @string)),
    Replaced = STUFF(
        @string,
        CHARINDEX(@maskStart, @string),
        CHARINDEX(@maskEnd, @string) - CHARINDEX(@maskStart, @string) + 1,
        REPLICATE('*', CHARINDEX(@maskEnd, @string) - CHARINDEX(@maskStart, @string)))
WHERE
    CHARINDEX(@maskStart, @string) > 0 AND
    CHARINDEX(@maskEnd, @string) > CHARINDEX(@maskStart, @string)

CHARINDEX will give you the position of a particular string inside another one (the first by default).

REPLICATE will repeat a string N amount of times, we use this for the mask.

STUFF will replace a string inside another one (the mask inside your original string) and at the same time remove an N amount of characters at the specified position.

My requirement was different from the post, posting here my solution as it may help someone else.

CREATE FUNCTION [dbo].[uf_MaskText] (@cText VARCHAR(255), @iNumberOfVisibleCharacters INT)
RETURNS VARCHAR(255)
AS

BEGIN
    IF ISNULL(@cText, '') <> ''
    BEGIN
        IF LEN(@cText) > @iNumberOfVisibleCharacters
        BEGIN
            DECLARE @iNumberCharacters INT = LEN(@cText)
            SET @cText = REPLICATE('*', @iNumberCharacters - @iNumberOfVisibleCharacters) + SUBSTRING(@cText, @iNumberCharacters - @iNumberOfVisibleCharacters + 1, @iNumberOfVisibleCharacters)
        END
    END
    RETURN @cText
END
GO

Perhaps i have misread the question but if you are to store this data you should be able to use Dynamic Data Masking against the target Column?

CREATE TABLE [dbo].[MaskingExample] (
[TargetString] Nvarchar(MAX) MASKED WITH (FUNCTION = 'partial (2,"******",2)) NOT NULL
)

Then just insert into your table the original Value,

INSERT INTO [dbo].[MaskingExample] (TargetString) VALUES ('TEST123456')

Provided you dont grant the unmask permission to a user the output will look like:

SELECT [TargetString] FROM [dbo].[MaskingExample]

If you grant the Unmask permission to a user and they queory the same data they will see the unmasked result.

https://learn.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking?view=sql-server-ver16