qsa.sh - External security scan of your own IP, in your terminal
by•
Run curl qsa.sh for a one-command external security scan of your server's own public IP — naabu, nmap + vulners, and nuclei map your open ports, service versions, and known CVEs, streamed straight to your terminal in ~30 seconds. See exactly what the internet sees of your host: no account, nothing stored. Free scans run live; paid Pro (all 65,535 ports, async) and one-time Deep (the full nuclei firehose, emailed) dig deeper uncovering vulnerabilities below the surface.
Replies
Really like how frictionless this is. curl qsa.sh scanning the IP you're calling from means it's guaranteed your own host with no account or consent faff, which is a genuinely clever bit of design, and not retaining results is the right call for trust.
One question from my corner: for those of us mostly on serverless/edge now (Cloudflare Workers and the like) where there's no box with an open IP to point at, is there a version of this that makes sense, or is it firmly aimed at VPS/server setups? Either way, nice work.
@dalemooney This version uses IP intelligence from WorldIP.io to classify the requesting IP, and it actively refuses detected proxies, VPNs, mobile devices, and Cloud platforms. However, because you're executing the command from your server and not the proxy egress, the scanner should pick up the actual IPv4 for proper scanning. All of my testing was completed on my web servers running Cloudflared.
@tuxxin Ah, that clears it up, appreciate you going into the detail. The VPN/cloud refusal is a smart default for keeping results clean. Only wrinkle for me is I'm fully serverless on Cloudflare Workers, so there's no origin box to run it from. Probably an edge case rather than something to design around, but might come up more as smaller teams go fully serverless. Nice tool either way.
Seeing my own setup the way a stranger on the outside would is oddly reassuring, and I like that it just tells me plainly what looks open without any fuss.
@amine_aziz_alaoui It is a very useful tool. I will be publishing a blog post soon with a how-to on setting up a crontab diff checker to auto-alert users when new vulns pop up. The entire micro-SaaS idea behind it is that everything is self-service. If you want auto-alerts with a diff checker, you create it, but our website will give you guidance. This keeps us from storing any data on users' server scans.
Nice that curl here just streams text back, no piping into bash like typical installers. The 15-second abort window before scanning starts is a smart consent mechanism too.
@aidan_codefox After doing the research that was the first thing I noticed and wanted to eliminate compared to many others out there, no piping/downloading (no trust) and wanted some type of terms acceptance, so I figured treat it like a checkout. It worked out nicely. Thanks for the feedback.
DiffSense
This i s great! Would love to try it! ...but .....Is it opensource? I couldnt find a github link. Runing curl is in it self a security risk. Basically you allow anything to run on your computer. No gatekeeper nothing. So having it be closed source is a very red flag 😅. Its fine to do from big vendors like claud eor openai. But small vendors, opensource + curl is a must. IMO. Thanks 🙏
@conduit_design I completely understand the concern! To clarify, you never pipe anything into your terminal here (e.g., curl qsa.sh | bash). We don't require that like other sites do, so nothing is downloading or executing code on your server. curl qsa.sh simply sends a standard web request. QSA reads the headers, and if the request comes from curl, it provides the results directly to your terminal (just like a website displays a page, but formatted for the CLI). It is a 100% external scan, not internal. To give you another example on this, another site of mine is curlhub.sh which "curl curlhub.sh" will provide you with an entire set of useful tools.
Is it open source? All of the scanning software we use (naabu, nmap + vulners, and nuclei) is open source. We've just put them together in an easy-to-use tool, though the website's wrapper code itself is closed source. The micro-SaaS idea is purely to save time for people who don't want to set up and maintain an entire security stack. One quick command gives you basic data, while the premium packages offer deeper, sub-surface scans.
DiffSense
@tuxxin Yes but curl executes anything past gatekeeper. So unless i can see what that is (opensource or source of the .sh file). It s very risky, and not recommended. Basically on the other side could be a simple call to extract my gh_toke, or grab my keychain files. or scan for crypto. and upload it anwyhere. and I wouldnt know. Also why does it have to be a curl. If it scans my IP. cant it be done on a remote server? why do i have to do it on my maschine?