qsa.sh

What is qsa.sh?

qsa.sh is a command-line security scanning service for server owners and developers. Users run curl qsa.sh from a host, and the service scans that host's public IP from the outside to show what the internet can see. It combines port discovery, service detection, known CVE checks, and nuclei templates, then streams results back to the terminal. The free flow needs no account and stores nothing, while paid modes offer deeper full-port or asynchronous scans.

How to use qsa.sh?

1. Open a terminal on the server or machine whose public IP should be scanned.
2. Run curl qsa.sh to start a live external scan.
3. Review the streamed results for open ports, detected services, versions, and possible CVEs.
4. Investigate unexpected exposed services or vulnerabilities in the server configuration.
5. Use Pro or Deep scan options when a broader full-port or nuclei-heavy scan is needed.

Core Features

• One-command scan - Starts from curl qsa.sh without installation or account setup.
• External viewpoint - Scans the machine's public IP from the internet side.
• Port discovery - Uses naabu and nmap-style checks to map reachable services.
• Vulnerability hints - Adds vulners and nuclei findings for known CVEs and exposure patterns.
• Terminal streaming - Returns results directly in the command line in about 30 seconds for free scans.
• Privacy-light workflow - Requires no login and states that free scans are not stored.
• Deeper paid scans - Offers full-port and larger nuclei scan options for more complete audits.

Use Cases

• Server hardening - Check whether a host exposes ports or services that should be closed.
• Deployment smoke test - Run a quick external scan after provisioning a new VPS or app server.
• Developer self-audit - Give solo developers a simple first-pass security check from the terminal.
• Incident triage - Quickly see externally visible services during a security review.