Skip to navigation
Features

Custom Headers

Overview

Custom headers allow you to configure HTTP headers that are automatically included with every request during penetration testing. This is essential for authentication and useful for tracking Pensar’s requests in your network logs.

Use Cases

Authentication

Add API keys, bearer tokens, or custom auth headers to access protected endpoints.

Request Tracking

Include identifiers to filter and monitor Pensar’s requests in your logs and monitoring tools.

Environment Routing

Add headers required by your infrastructure for routing to specific environments or backends.

Feature Flags

Include headers that enable specific features or test configurations in your application.

Configuring Custom Headers

2

Add a Header

Enter the header name and value in the input fields:

  • Header Name: The HTTP header name (e.g., Authorization, X-API-Key)
  • Header Value: The value for the header (e.g., Bearer your-token-here)

Click Add to save the header.

3

Manage Headers

View all configured headers in the table. Click the X button to remove a header (you’ll be asked to confirm deletion).

Common Examples

Authentication Headers

Authorization: Bearer iOiJIUzI1NiIsInR5csCI6IkpXVCJ9...
X-API-Key: your-api-key-here

Request Tracking

Add a custom header to identify Pensar’s requests in your logs:

X-Pensar-Test: security-scan-2024
X-Request-Source: pensar-pentest

This makes it easy to:

  • Filter Pensar’s requests in your log aggregation tools
  • Exclude test traffic from analytics
  • Monitor scan activity in real-time
  • Correlate findings with specific requests

How It Works

Custom headers are merged with the default headers for every HTTP request the agent makes:

  1. Your custom headers are loaded when the scan starts
  2. Each http_request tool call includes your headers automatically
  3. Command-line tools (curl, etc.) also include the headers when applicable

Custom headers are applied in addition to the default User-Agent: pensar-apex header. If you specify a custom User-Agent, it will override the default.