There's a lot of ways to get information out of databases through SQL Injection (similar techniques can work for other injection avenues as well).
First, there's error based - you deliberately create invalid request and the webpage helpfully hands you back a full SQL statement with what's wrong with it. You can use this to guess table names and confirm whether you are right. This one only works with websites that are not properly configured - 500 (server error) pages should NEVER return debugging / stack / database information, ever. That data should be logged and a friendly, non-specific message should be given to end users.
Second, there's taking advantage of queries that display data. If you've got a page that is displaying rows of data, the attacker can tack on a Union and another select, guessing the number of columns that the query is expecting (you can do this by trial and error) and the database tables that provide table/column data. This will provide them all the tables and their columns and they can use that information to extract further information or do damage with updates and deletes.
Third, if you can't actually get any data out (because the only injectable statement doesn't return any data (an update for instance), you can do what is called Blind SQL Injection. You can cause the database to leak information just by its success and failure - you can guess table names and see if the update succeeded or failed. You can even guess column values and use that to leak data - is there a user whose name starts with a? b? that the second character is o? that the third character is b? Oh, there's a user named Bob. Obviously, this is best scripted, since leaking quantities of data this way takes a LOT of requests, but not as many as you might think. Blind SQL Injection can also be done timing based rather than error based - basically if a condition is true, they put a sleep in and use the difference in the query execution time to determine if the condition was true or false.
Hopefully this will help you find more information on each of these. There are likely variants and other techniques that I am not familiar with - my role is not primarily pen-testing, but rather secure software development practices.
