qsa.sh – An instant external security scan of your IP via curl

Ever wondered what your server or home network looks like to an attacker on the open internet?

Checking your exposed attack surface usually requires downloading heavy security tools, configuring complex CLI flags, or signing up for bloated SaaS platforms. We built qsa.sh to fix that.

It’s an instant, outside-in security scanner that evaluates your public IP address directly from your command line. No installation, no account creation, no hassle.

Just open your terminal and run:

curl qsa.sh

How It Works Under the Hood

When you execute the command, qsa.sh triggers a real, external port and vulnerability scan against the public IP address you are connecting from. Results stream live back to your terminal window in ~30 seconds.

Behind the scenes, qsa.sh orchestrates proven, industry-standard open-source security tools:

• naabu for lightning-fast TCP port discovery.
• nmap + vulners for precise service versioning and CVE mapping.
• nuclei to run thousands of targeted vulnerability checks.

Instead of waiting for a PDF report or navigating a complex UI, you get actionable security telemetry right where you already work: your terminal.

Safety, Privacy, and Responsible Scanning First

Building a tool that triggers automated security scans via curl requires aggressive guardrails. We’ve baked safety, consent, and privacy into the core architecture:

• Strict Self-Scanning Only: There is no target input field. You cannot use qsa.sh to scan someone else—it only scans the IP address making the HTTP request.
• The 15-Second Abort Window: Before a single packet is sent, qsa.sh prints your detected public IP address and starts a 15-second grace period. Don't want to scan? Just hit Ctrl-C to abort.
• Automatic Refusals: To prevent collateral damage and false positives, scans from CGNAT networks, mobile carriers, VPNs, Tor exit nodes, and IPv6 origins are automatically rejected.
• Zero Data Retention: Your scan results are entirely ephemeral and streamed live over stdout. Nothing is saved to disk, and no databases store your vulnerability reports.

Finding the Right Tier for Your Workflow

Whether you need a quick pulse check or a deep audit across all 65,535 ports, we offer three simple tiers:

Free Tier ($0) — Quick Surface Snapshot

• Command: curl qsa.sh
• Speed: ~30 seconds (Live stream)
• Scope: Top 1,000 TCP ports & ~2,000 curated vulnerability checks
• Limits: 1 scan per IP per day
• Output: Exposed ports, service versions, and top 3 findings

Full Pro ($5 / month) — Complete Surface Coverage

• Command: curl https://qsa.sh/<token>
• Speed: ~2–12 minutes (Async return)
• Scope: All 65,535 TCP ports & ~2,000 curated vulnerability checks
• Limits: 1 scan per IP per hour
• Output: Full list of findings with actionable remediation steps

Deep ($7 / scan) — Full Audit & Pentest Report

• Command: curl https://qsa.sh/<token>
• Speed: ~13–16 minutes
• Scope: All 65,535 TCP ports & full set of 10,500+ vulnerability checks + custom scripts
• Limits: Unlimited scans per IP
• Output: Emailed comprehensive security report with full remediation guidance

Try It Right Now

You don't need an account or an API key to test your current setup. Open a terminal window, check your external posture, and see what the internet sees:

curl qsa.sh