I am thinking in the future I may want to buy burp suite pro. I am concerned it may be a privacy risk. If I configure burp suite to use tor will that be canceled out by my payment method? Does it matter if I pay in bitcoin or debit card? Or is portswigger good with privacy?
“Privacy risk” is a very broad concept, and depends very much on what you want to keep private. Giving appropriate guidance is difficult without knowledge about the specific situation, but I’ll try.
Burp Suite is proprietary software, so I wouldn’t trust it with anything important in any case. PortSwigger should be located in the UK, which is not the worst nor the better location for privacy regulations: trusting them or not is your choice. I wouldn’t.
If you pay with credit/debit card, your subscription is surely linked to your identity.
I don’t know much about Bitcoin, but what I read is that it is not private at all, as all transactions are public. Think of it as if your bank statement was published online, in real time and forever, for anyone to read, just without your name attached to it by default - but if you link it to yourself, there is no way back.
About running Burp Suite through tor, note that tor can do nothing more than hiding your IP address from the servers you connect to, and only if Burp Suite complies with your settings. Tor can’t do anything to protect you from the producer of the software you use, unless the producer cooperates.
Also, I suspect most of the items on Burp Suite features list breaks if you run it through tor. But if it worked enough for you, whether the privacy improvement is “canceled out” by the payment depends on what you are concerned about.
Is it a problem if PortSwigger knows your home address? If so, you shouldn’t give them any money unless you pay cash.
Is it a problem if they know which websites you study? If so, you shouldn’t use Burp Suite at all.
Is your only concern that they shouldn’t learn about your medical conditions? If so don’t worry, pay them and use their software, just don’t run Burp Suite against your physician’s homepage too often.
I haven’t paid them anything but let me ask this too. If I use it for free is there a good chance burp suite tracks my web browsing activity? How much would you worry if you were using it?
I have no idea how trustworthy PortSwigger is, so take everything with a grain of salt.
I think it is unlikely that Burp Suite tracks connections you don’t run through it and it is possible that it reports back some information on the analyses you carry out. Stuff like domain names, full page URLs, or kind of analysis.
Again, whether and how much you should worry depends on your threat model. If you play around with random websites you are probably fine as long as you don’t login with your main accounts, but if you run vulnerability assessments for a big company your customer surely requires you make sure that nobody even knows about your contract with them.
Burp Suite is not free software, which is enough for me not to use it, both for ethical and technical reasons. If I used it, I’d probably run it behind a VPN and on a device without sensitive data in it (for my own privacy) and stop as soon as I had a hint about a vulnerability of my target (to protect their users’ privacy, should I get access to anything).