I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks and which software do I use? I came to know about some software like Nessus and Burp suite.
You need to move away from Windows if you really want to learn anything about "hacking". Yes, you can do some stuff with Cain and Abel and some GUI tools, but that isn't the right way to learn about computer security.
This is where I started. First, become familiar with a beginner Linux distribution, the command line, and how it differs from Windows. There are great books as well as online resources available. One of my personal favorites is http://explainshell.com, plug in a command and it will explain the command and any included arguments. Once you feel okay with this, dual boot Kali Linux on your computer and experiment! There is a huge catalog of pentesting tools to be explored and many tutorials online.
Learn how the tools work, instead of using them to achieve an ends. "Look I can see people's passwords!" vs "That HTTP post form is unencrypted so if I ARP poison and inspect the packets, I can see everyone's plaintext credentials". That kind of understanding will go a long way.
First - Nessus checks for vulnerabilities.
There's a massive array of places to get educated. If you're wanting to learn for illegal activities, you're on your own. If it's for ethical hacking aka penetration testing then check these out:
The Basics of Hacking and Penetration Testing, Second Edition [Book]
Sans.org [Classes, free white papers]
OWASP [A-Z on how to perform tests]
Securitytube.net [Videos on hacking]
Owasp is a very good site to learn more about web security.
A fun game to learn XSS
Another game for SQL Injection