sqlmap

sqlmap -u "<url>?id=1" --batch --dbs

Automates detection and exploitation of SQL injections, enumerating databases, tables, and data.

When you find a GET or POST parameter that appears vulnerable to SQLi and want to extract information automatically. sqlmap is the standard: it detects the injection type, the database engine, and gives you options for data dump. In an engagement, you use it after manually confirming the vulnerability with a ' or a simple payload.

If the site has a strong WAF that blocks sqlmap payloads, or if the injection is blind and very slow, it can take hours. Also if the target is critical and you don't want the risk of modifying data (sqlmap can do INSERT/UPDATE by default if asked). Prefer manual testing or quieter tools.