How qsa.sh works

qsa.sh is a hosted remote scanner. You run one command; the scan runs from our infrastructure against the public IP you connected from, and the findings stream back to your terminal. There is nothing to download and nothing to install.

Step by step

  1. You run curl qsa.sh. We read the public IP of your connection from the trusted edge — you cannot set or spoof the target — and refuse it immediately if it’s a known CGNAT or mobile-carrier range, an IPv6 origin we can’t yet reputation-check, or an address our reputation data flags as a proxy, VPN, or Tor/relay.
  2. Before any packet is sent, curl prints the detected IP and an authorization warning, then a 15-second countdown. Press Ctrl-C to decline — nothing is scanned. Continuing past the countdown is your authorization confirmation; this pre-scan window is the real consent gate.
  3. Once the countdown ends, our scanner nodes probe that one IP and stream each finding — open ports, detected service and version, TLS posture, known-CVE flags — back to you as it’s discovered, under a hard time cap.
  4. When the scan finishes (or you disconnect, or the time cap is reached) it stops. Results are streamed only; nothing is written to disk.

Pipe-friendly output

For logging or scripting, request escape-free plain output with curl qsa.sh?nocolor=1, the X-No-Color header, or a non-interactive tool such as wget. The default output is coloured for a live terminal.

The exact tools we run

There’s no black box here. qsa.sh runs the same open-source tools a security engineer would run by hand — we just run them for you, fast, and curate the noise. You’re paying for the compute and convenience, not secret sauce.

naabu 2.6.1

fast SYN-based port discovery. Finds which TCP ports are open.

nmap 7.93 with the vulners NSE script

fingerprints the service and exact version on each open port, then maps that version straight to known CVEs.

nuclei 3.3.9 with the public nuclei-templates

thousands of community-maintained checks for exposures (.env, .git, config leaks), default logins, subdomain and service takeovers, TLS misconfigurations, and version-matched CVEs.

You could install and run all three yourself — they’re free and open. If you’d rather not fight with Go toolchains, template flags and CVE feeds, we run them for you in seconds, curated to the checks that actually matter — and paying keeps the free scan free for everyone.

Powered by open-source naabu 2.6.1, nmap 7.93 + vulners, and nuclei 3.3.9 with the public nuclei-templates — no proprietary, black-box software.

What runs at each tier

We publish exactly what each tier does, down to the flags and template scope — so you can see there’s nothing hidden.

Free

curl qsa.sh

live · ~30s · $0

  • Ports: naabu, top 1,000 TCP ports.
  • Service + CVE: nmap -sV --script vulners on every open port.
  • Vulnerability checks: ~2,000 curated high-signal nuclei templates — exposures (.env/.git), default logins, takeovers, TLS issues, and KEV + critical/high CVEs matched to the services we detected.
  • Output: open ports, service/versions, a severity breakdown (counts), and the top 3 findings shown in full, plus an honest note on what the paid tiers add.
  • Stored: nothing.

Full / Pro

curl https://qsa.sh/{token}

async · ~2–12 min · $5/mo

  • Ports: naabu, all 65,535 TCP ports.
  • Service + CVE: nmap -sV --script vulners.
  • Vulnerability checks: ~2,000 high-signal nuclei checks, run across all 65,535 ports (not just the top 1,000).
  • Output: the full finding list plus remediation guidance.

Deep

curl https://qsa.sh/{token}

async · ~13–16 minutes · $7 one-time

  • Ports: naabu, all 65,535 TCP ports.
  • Service + CVE: nmap -sV --script vulners.
  • Vulnerability checks: the entire ~10,500-template nuclei set, all severities, plus our own custom templates — the raw firehose you’d get running nuclei yourself with no filters.
  • Output: the complete report, emailed to you when it finishes, with a self-expiring results link.

The free scan is live now; Full and Deep follow. See Pricing.

Zero third-party targeting

Every tier can only scan the IP you connect from — the address shown in the warning before the scan starts. There is no field to type another target, on the free scan or on any paid tier. A paid token isn’t “scan this IP for me”; it’s redeemed by running the command from the server you want scanned, so the target is always your own connecting address. Connections from known CGNAT or mobile-carrier ranges, from IPv6 (which we can’t yet reputation-check — run curl -4 qsa.sh), or ones our reputation data flags as a proxy, VPN, or Tor/relay are refused (best-effort, IPv4-only); your own cloud, hosting, or datacenter IP is not. Any address on our opt-out list is never scanned.

Before any packet is sent you get a 15-second countdown — press Ctrl-C to decline and nothing is scanned; continuing past it is your authorization. Free scanning is limited to 1 scan per 24 hours per IP (paid keys get their own cadence — Full 1 / hour, Deep unlimited) with a global capacity cap; under unusually high demand new scans briefly pause with a “try again shortly” notice, then recover automatically. Connections we identify as CGNAT, mobile-carrier, IPv6, or an anonymizing proxy/VPN/Tor are refused (best-effort, IPv4-only) so you can only scan your own origin — your own cloud or hosting IP is fine.

Frequently asked questions

Does qsa.sh scan other people’s servers?
No — only the public IP of the connection making the request.
Do you store my results?
No. Results stream live and are never written to disk.
Is this legal?
Scanning an IP you own or are authorized to test is fine; unauthorized scanning may be illegal. See the Acceptable Use Policy.
Can I scan a shared/CGNAT IP?
No — connections from known CGNAT or mobile-carrier ranges are refused, because the address covers people other than you and no one user can authorize the whole gateway. IPv6 origins are refused too (we cannot yet reputation-check them — run curl -4 qsa.sh).
Why one command with no | bash?
For safety and honesty — qsa.sh never asks you to pipe anything into a shell.
What tools do you actually run?
naabu 2.6.1 for port discovery, nmap 7.93 with the vulners script for service/version and CVE mapping, and nuclei 3.3.9 with the public nuclei-templates for vulnerabilities and exposures — all open-source. See the exact tools we run.
What’s the difference between Free, Full and Deep?
Free is the ~30-second streaming scan (top 1,000 ports, ~2,000 curated checks). Full sweeps all 65,535 ports with ~2,000 high-signal checks, async; Deep adds the complete ~10,500-template set plus our own custom checks, emailed. See Pricing.