Launching today
qsa.sh
External security scan of your own IP, in your terminal
90 followers
External security scan of your own IP, in your terminal
90 followers
Run curl qsa.sh for a one-command external security scan of your server's own public IP — naabu, nmap + vulners, and nuclei map your open ports, service versions, and known CVEs, streamed straight to your terminal in ~30 seconds. See exactly what the internet sees of your host: no account, nothing stored. Free scans run live; paid Pro (all 65,535 ports, async) and one-time Deep (the full nuclei firehose, emailed) dig deeper uncovering vulnerabilities below the surface.
Really like how frictionless this is. curl qsa.sh scanning the IP you're calling from means it's guaranteed your own host with no account or consent faff, which is a genuinely clever bit of design, and not retaining results is the right call for trust.
One question from my corner: for those of us mostly on serverless/edge now (Cloudflare Workers and the like) where there's no box with an open IP to point at, is there a version of this that makes sense, or is it firmly aimed at VPS/server setups? Either way, nice work.
qsa.sh
@dalemooney This version uses IP intelligence from WorldIP.io to classify the requesting IP, and it actively refuses detected proxies, VPNs, mobile devices, and Cloud platforms. However, because you're executing the command from your server and not the proxy egress, the scanner should pick up the actual IPv4 for proper scanning. All of my testing was completed on my web servers running Cloudflared.
@tuxxin Ah, that clears it up, appreciate you going into the detail. The VPN/cloud refusal is a smart default for keeping results clean. Only wrinkle for me is I'm fully serverless on Cloudflare Workers, so there's no origin box to run it from. Probably an edge case rather than something to design around, but might come up more as smaller teams go fully serverless. Nice tool either way.
qsa.sh
@dalemooney That’s an interesting thought, but a fully serverless approach raises some tricky issues. The biggest challenge is authorization, we couldn't verify the user actually has permission to scan the target servers. Even if we dropped the port and vulnerability checks, the Nuclei scripts are aggressive enough that they'd likely trigger DDoS protections instantly. On top of that, even with a whitelisted IP, I'd have to check if Cloudflare's AUP allows that kind of scanning. It's definitely an edge case worth keeping on my radar, though. Appreciate the feedback!
DiffSense
This i s great! Would love to try it! ...but .....Is it opensource? I couldnt find a github link. Runing curl is in it self a security risk. Basically you allow anything to run on your computer. No gatekeeper nothing. So having it be closed source is a very red flag 😅. Its fine to do from big vendors like claud eor openai. But small vendors, opensource + curl is a must. IMO. Thanks 🙏
qsa.sh
@conduit_design I completely understand the concern! To clarify, you never pipe anything into your terminal here (e.g., curl qsa.sh | bash). We don't require that like other sites do, so nothing is downloading or executing code on your server. curl qsa.sh simply sends a standard web request. QSA reads the headers, and if the request comes from curl, it provides the results directly to your terminal (just like a website displays a page, but formatted for the CLI). It is a 100% external scan, not internal. To give you another example on this, another site of mine is curlhub.sh which "curl curlhub.sh" will provide you with an entire set of useful tools.
Is it open source? All of the scanning software we use (naabu, nmap + vulners, and nuclei) is open source. We've just put them together in an easy-to-use tool, though the website's wrapper code itself is closed source. The micro-SaaS idea is purely to save time for people who don't want to set up and maintain an entire security stack. One quick command gives you basic data, while the premium packages offer deeper, sub-surface scans.
DiffSense
@tuxxin Yes but curl executes anything past gatekeeper. So unless i can see what that is (opensource or source of the .sh file). It s very risky, and not recommended. Basically on the other side could be a simple call to extract my gh_toke, or grab my keychain files. or scan for crypto. and upload it anwyhere. and I wouldnt know. Also why does it have to be a curl. If it scans my IP. cant it be done on a remote server? why do i have to do it on my maschine?
qsa.sh
@conduit_design I think there's a slight misunderstanding about how curl works here! qsa.sh is a website domain, not a script file. Running curl qsa.sh merely fetches the HTTP response body and displays it. Unless you explicitly pipe that output to an interpreter (e.g., curl qsa.sh | bash), absolutely no code is executed on your machine whatsoever.
You are completely right that the scan should happen remotely—and it does! My backend sees your incoming web request, grabs the requesting IP, runs the scan from our servers, and then prints the results back to your CLI.
DiffSense
@tuxxin You might be right. In how you use curl for this, it cannot install or run anything. But today primarly curl is used to install qwen cli. or Cline cli etc. As a install path that subvert gatekeeper. However the insight into a curl that execute or a curl that doesnt isnt common knowledge. And my point about why do I even have to run curl stands. Why not just copy paste my ip into a website? Or not even that. just detect the ip on the website. then all the user has todo is press. scan my ip.
Nice that curl here just streams text back, no piping into bash like typical installers. The 15-second abort window before scanning starts is a smart consent mechanism too.
qsa.sh
@aidan_codefox After doing the research that was the first thing I noticed and wanted to eliminate compared to many others out there, no piping/downloading (no trust) and wanted some type of terms acceptance, so I figured treat it like a checkout. It worked out nicely. Thanks for the feedback.
Seeing my own setup the way a stranger on the outside would is oddly reassuring, and I like that it just tells me plainly what looks open without any fuss.
qsa.sh
@amine_aziz_alaoui It is a very useful tool. I will be publishing a blog post soon with a how-to on setting up a crontab diff checker to auto-alert users when new vulns pop up. The entire micro-SaaS idea behind it is that everything is self-service. If you want auto-alerts with a diff checker, you create it, but our website will give you guidance. This keeps us from storing any data on users' server scans.
honestly the one-curl approach is kind of genius — no signup wall, just instant results streamed to your terminal. love that the free scan stays honest about what the internet actually sees instead of burying the real findings behind a paywall.