Web Application Penetration Testing Cheat Sheet
I was using sqlmap once and was genuinely surprised how good UI it has. It automatically does so much guesswork and only asks highly important questions, but at the same time it never gets in the way. Also, it does few other things beside just SQL injection, and it surprisingly gave me shell access when I was not even looking for it.