Scan Header

The Chariot HTTP header and chariot- User-Agent Guard puts on scan traffic so you can allowlist it, plus the OOB callback host.

Scan Header

Scan Header is the unique identifier Guard includes on outbound scan traffic for this account. Click the value to copy Chariot: <hash> to the clipboard.

The hash is the MD5 of the account email. The UI and the scanner both compute it the same way, so the copied string matches live traffic.

What actually goes on the wire

MarkerFormat
Chariot headerChariot: <md5>
User-Agentchariot-<md5>

Nuclei vulnerability templates send both. Other web scanners send the Chariot header; screenshot capture also uses a custom user-agent.

Allowlist either marker in a WAF, IDS, or SIEM: header Chariot present, or User-Agent starting with chariot-.

Out-of-band callbacks

Nuclei tests for blind classes (SSRF, XXE, blind XSS, SMTP injection) embed callback URLs on oob.guard.praetorian.com. If a target is vulnerable, it makes an outbound DNS or HTTP request to that host. Blocking egress to *.oob.guard.praetorian.com does not fail the scan, but Guard cannot confirm those blind findings.

Who can change it

Nobody. The header is determined by the account identity. You only copy it.