I am trying to learn "SQL Injection" concepts and also trying to practice some Kali tools to learn, but there is a question that I do not understand and my question is why do most tools need URL's that end with "AAA.BBB?id=000" as a input string for injection.
When you see URL's that have that kind of syntax id=123, there is a good chance the underlying code will use 123 as input to some kind of dynamic SQL statement. Unless the underlying code is written to prevent SQL injection, you can gain additional information from the database (or cause harm) by simply adding additional information to the url directly in the browser window.
Have a look at SQL Injection Walkthrough
What is SQL Injection? It is a trick to inject SQL query/command as an input possibly via web pages. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. With SQL Injection, it is possible for us to send crafted user name and/or password field that will change the SQL query and thus grant us something else.
What do you need? Any web browser.
Try to look especially for URL that takes parameters, like:
There are numerous examples of SQL injection in the post I referenced above.