There is no reason to overthink your penetration testing setup. As long as you are working with established tools from renowned companies - you mentioned burp as a good example - you can trust them as much as any other third party software you install on your system. There is also no reason to protect your anonymity, as you are doing nothing illegal.
Take a look at the OWASP ASVS, the application security verification standard. It is focused on web applications and provides a guideline for the security tests you should perform during a penetration test. Especially chapter V1.2 and chapter V2 cover a broad range of tests that should be done in regard to authentication. Keep in mind that some of them ...
Yup we have an FAQ for that: https://www.zaproxy.org/faq/what-options-exist-for-selective-proxying/
Via a Browser Add-on/Extension
Via Global Excludes
Via a PAC (Proxy Auto-Config) File
Set “No Proxy For” in Your Browser
Just researched the same issue; the syntax for adding sites/targets with vhosts (SNI) is:
wmap_sites -a example.com,http://192.168.1.1
wmap_targets -t example.com,http://192.168.1.1
This situation continues even after some time asked. I`ve been going through this for some time now and have to turn on debugging on the scans(pressing d repeatedly for the desired level and D to decrease to the desired level) to level three to see what is happening behind the scenes.
You can get port 21, 22, 80, 8080 when none of these are up on the hosts. ...