Well, it really depends on the type of attack and the level of sophistication of  the hacker.

    Btw, SQLmap is one of the most popular and widely used tools, ESPECIALLY for SQL injection attacks.

    But why SQLmap?

    -Automation: Facilitates detection and exploitation of SQL injection vulnerabilites with little effort.
    -Compatibility: Works with a variety of DB (MySQL, Postgre, Oracle, SQLite...)
    -Easy to use: It has a simple interface and accessible documentation
    -Extracts data from DB: Obtains password hashes and decrypts them

Andddddddddddddd

Other popular tools:

-Nmap: To discover open ports and exposed services
-Hydra: For brute force attacks on DB with weak credentials
-Metasploit Framework: Used to exploit  know vulnerabilities

Remember that each tool depends on the context