Scan Header

The Chariot HTTP header and chariot- User-Agent Guard puts on scan traffic so you can allowlist it, plus the OOB callback host.

Scan Header

Scan Header is the unique identifier Guard includes on outbound scan traffic for this account. Click the value to copy Chariot: <hash> to the clipboard.

The hash is the MD5 of the account email. The UI and the scanner both compute it the same way, so the copied string matches live traffic.

What actually goes on the wire

Every HTTP scan request can carry two markers derived from that hash:

Marker	Format
`Chariot` header	`Chariot: <md5>`
`User-Agent`	`chariot-<md5>`

Nuclei vulnerability templates send both. Other web scanners that use the same CHARIOT_HEADER / CHARIOT_USER_AGENT job hooks send the same markers.

Use either marker in a WAF, IDS, or SIEM allowlist:

Header Chariot present
User-Agent starts with chariot-

These markers are identification only. Anyone can send the same header or User-Agent. Do not use them to skip authentication or authorization.

Out-of-band callbacks

Nuclei tests for blind classes (SSRF, XXE, blind XSS, SMTP injection) embed callback URLs on:

oob.guard.praetorian.com

If a target is vulnerable, it makes an outbound DNS or HTTP request to that host. Blocking egress to *.oob.guard.praetorian.com does not fail the scan, but Guard cannot confirm those blind findings.

Who can change it

Nobody. The header is determined by the account identity. You only copy it.