SlingTrace turns HTTP traffic from a Burp project into an offline HTML report. It is the Trace tool in Elah Project: a way to review the hosts, activity, and endpoints captured during a test.
SlingTrace reads capture times and linked responses from a recognized Burp Proxy history layout. Other layouts use a cautious HTTP text scan, which may miss records or their times. The report describes captured traffic; it cannot confirm completed tests or vulnerabilities. Compare its counts with Burp before treating them as a complete history.
SlingTrace supports Python 3.10–3.12. From the project directory:
python3 -m venv .venv
. .venv/bin/activate
python -m pip install -r requirements.lock
python -m pip install --no-deps -e .
slingtrace-webOpen http://127.0.0.1:5000. Choose a .burp file, select the hosts you care about, and generate a Detailed report or Executive summary. You can open the result in the browser or download the HTML and its manifest. The app listens on localhost and does not use accounts.
The default upload limit is 256 MiB. For a larger file, set a suitable limit before starting the server, for example:
SLINGTRACE_MAX_UPLOAD_MB=2048 slingtrace-webThe limit can be set as high as 4096 MiB. The CLI below reads the file directly and has no web upload limit.
slingtrace project.burp --scope '(^|\.)example\.com$' --output reports/engagement.htmlThe CLI makes a Detailed report. If you omit --output, it writes reports/report.html by default; SLINGTRACE_REPORT_DIR can change that directory. A sibling .manifest.json records the source hash, selected options, coverage status, and parser diagnostics. Run slingtrace --help for the full flag list.
The Detailed report has a UTC activity view, traffic breakdown, searchable endpoint inventory, and linked Burp notes when available. Filter by host, method, response status, or activity; sort within each host; then export all endpoints or just the filtered rows. Exports include observed paths, normalized patterns, captured ID values, a host-to-path CSV, and full JavaScript URLs.
The Executive summary is shorter: an overview, host and subdomain comparison, a matrix of endpoint patterns seen on multiple hosts, an activity map, and a printable one-page brief. Choose it in the web app. It does not include the detailed inventory or its export controls.
Both reports are self-contained HTML files that work offline. They may contain sensitive hostnames, paths, and URLs, so keep them with the rest of your engagement material.
Burp projects are not bundled with the repository. By default, temporary web data goes in data/ and generated reports go in reports/; those folders and all *.burp files are ignored by Git. If you save a report elsewhere, check it before committing.
The user guide walks through host selection, dates, filters, exports, and the limits of what can be read from a project.