qsa.sh is a developer-focused, terminal-based security tool designed to provide an instant external security scan of your server's public IP address. By simply running a single command—curl qsa.sh—users can evaluate how their host appears to the outside internet in roughly 30 seconds.

Under the hood, the tool leverages industry-standard scanning utilities including naabu, nmap (combined with vulners), and nuclei to map out open ports, detect service versions, and flag known CVEs. Results are streamed directly into your terminal.

Emphasizing privacy and convenience, free scans run live with no account required and nothing stored on external servers. For more thorough testing, optional paid tiers include Pro (covering all 65,535 ports asynchronously) and Deep (delivering the full nuclei vulnerability firehose directly to your email).

Pros of qsa.sh

Extremely fast and simple one-command execution via curl
No account creation required for free live scans
Nothing is stored, ensuring user privacy
Combines powerful security engines like naabu, nmap, and nuclei directly in your terminal

Cons of qsa.sh

Free scans are limited compared to Pro and Deep tiers
Comprehensive scanning options (like all 65,535 ports or full nuclei firehose) require paid or one-time upgrades
Terminal-only interface may not suit users who prefer a graphical dashboard

Frequently Asked Questions

How do I run a security scan using qsa.sh?

You can run a free live scan by simply executing the command 'curl qsa.sh' in your terminal.

What tools power the qsa.sh security scan?

The scan utilizes naabu, nmap + vulners, and nuclei to map open ports, detect service versions, and identify known CVEs.

Do I need an account to use qsa.sh?

No account is required for free live scans, and nothing is stored.

What paid options are available for deeper analysis?

The paid Pro tier scans all 65,535 ports asynchronously, while the one-time Deep tier delivers the full nuclei vulnerability firehose straight to your email.