How qsa.sh works

qsa.sh is a hosted remote scanner. You run one command; the scan runs from our infrastructure against the public IP you connected from, and the findings stream back to your terminal. There is nothing to download and nothing to install.

A scan of your perimeter, run from outside it

Every step happens on the public side of your perimeter. qsa.sh scans the address you connect from, the same way any stranger on the internet sees it - there is no agent, no install, and no path into your machine or network.
  1. Your terminal. You run curl qsa.sh. That is the only thing on your side, and it only makes an outbound request.
  2. qsa.sh edge. Reads the public IP your connection came from. You cannot set or spoof the target.
  3. Scanner fleet. The job is queued to our scanners, which run on a separate network with their own egress IP. They run naabu, nmap + vulners and nuclei.
  4. Your public IP. Probed from the outside, the same way any stranger on the internet sees it.
  5. Findings stream back to your terminal as they are discovered.
  6. Your device, files and LAN are never reached. Nothing is installed, and there is no path inward.

Step by step

  1. You run curl qsa.sh. We read the public IP of your connection from the trusted edge - you cannot set or spoof the target - and refuse it immediately if it's a known CGNAT or mobile-carrier range, an IPv6 origin we can't yet reputation-check, or an address our reputation data flags as a proxy, VPN, or Tor/relay.
  2. Before any packet is sent, curl prints the detected IP and an authorization warning, then a 15-second countdown. Press Ctrl-C to decline - nothing is scanned. Continuing past the countdown is your authorization confirmation; this pre-scan window is the real consent gate.
  3. Once the countdown ends, our scanner nodes probe that one IP and stream each finding - open ports, detected service and version, TLS posture, known-CVE flags - back to you as it's discovered, under a hard time cap.
  4. When the scan finishes (or you disconnect, or the time cap is reached) it stops. Results are streamed only; nothing is written to disk.

Pipe-friendly output

For logging or scripting, request escape-free plain output with curl qsa.sh?nocolor=1, the X-No-Color header, or a non-interactive tool such as wget. The default output is coloured for a live terminal.

The exact tools we run

qsa.sh runs the same open-source tools a security engineer would run by hand. We run them for you, fast, and curate the noise. You are paying for the compute and the convenience.

naabu 2.6.1

fast SYN-based port discovery. Finds which TCP ports are open.

nmap 7.99 with the vulners NSE script

fingerprints the service and exact version on each open port, then maps that version straight to known CVEs.

nuclei 3.11.1 with the public nuclei-templates

thousands of community-maintained checks for exposures (.env, .git, config leaks), default logins, subdomain and service takeovers, TLS misconfigurations, and version-matched CVEs.

You could install and run all three yourself - they're free and open. If you'd rather not fight with Go toolchains, template flags and CVE feeds, we run them for you in seconds, curated to the checks that matter for the services we find - and paying keeps the free scan free for everyone.

Powered by open-source naabu 2.6.1, nmap 7.99 + vulners, and nuclei 3.11.1 with the public nuclei-templates - no proprietary, black-box software. We write up each engine upgrade in the latest engine update, and everything else lands in News.

What runs at each tier

We publish exactly what each tier does, down to the flags and template scope - so you can see there's nothing hidden.

Free

curl qsa.sh

live - ~30s - $0

  • Ports: naabu, top 1,000 TCP ports.
  • Service + CVE: nmap -sV --script vulners on every open port.
  • Vulnerability checks: ~2,000 curated high-signal nuclei templates - exposures (.env/.git), default logins, takeovers, TLS issues, and KEV + critical/high CVEs matched to the services we detected.
  • Output: open ports, service/versions, a severity breakdown (counts), and the top 3 findings shown in full, plus an honest note on what the paid tiers add.
  • Stored: nothing.

Full / Pro

curl https://qsa.sh/{token}

async - ~2-12 min - $5/mo

  • Ports: naabu, all 65,535 TCP ports.
  • Service + CVE: nmap -sV --script vulners.
  • Vulnerability checks: ~2,000 high-signal nuclei checks, run across all 65,535 ports (not just the top 1,000).
  • Output: the full finding list plus remediation guidance.

Deep

curl https://qsa.sh/{token}

async - ~13-16 minutes - $7 one-time

  • Ports: naabu, all 65,535 TCP ports.
  • Service + CVE: nmap -sV --script vulners.
  • Vulnerability checks: the entire ~10,500-template nuclei set, all severities, plus our own custom templates - the raw firehose you'd get running nuclei yourself with no filters.
  • Output: the complete report, emailed to you when it finishes, with a self-expiring results link.

All three tiers are live today - the free scan needs no account. See Pricing.

Zero third-party targeting

Every tier can only scan the IP you connect from - the address shown in the warning before the scan starts. There is no field to type another target, on the free scan or on any paid tier. A paid token isn't "scan this IP for me"; it's redeemed by running the command from the server you want scanned, so the target is always your own connecting address. Connections from known CGNAT or mobile-carrier ranges, from IPv6 (which we can't yet reputation-check - run curl -4 qsa.sh), or ones our reputation data flags as a proxy, VPN, or Tor/relay are refused (best-effort, IPv4-only); your own cloud, hosting, or datacenter IP is not. Any address on our opt-out list is never scanned.

Before any packet is sent you get a 15-second countdown - press Ctrl-C to decline and nothing is scanned; continuing past it is your authorization. Free scanning is limited to 1 scan per 24 hours per IP (paid keys get their own cadence - Full 1 / hour, Deep unlimited) with a global capacity cap; under unusually high demand new scans briefly pause with a "try again shortly" notice, then recover automatically. Connections we identify as CGNAT, mobile-carrier, IPv6, or an anonymizing proxy/VPN/Tor are refused (best-effort, IPv4-only) so you can only scan your own origin - your own cloud or hosting IP is fine.

Frequently asked questions

Can an online port scanner scan an IP that isn't mine?
No - only the public IP of the connection making the request.
Do online port scanners store your scan results?
No. Results stream live and are never written to disk.
Is it legal to run a port scan on your own server?
Scanning an IP you own or are authorized to test is fine; unauthorized scanning may be illegal. See the Acceptable Use Policy.
Can you port scan a shared or CGNAT IP address?
No - connections from known CGNAT or mobile-carrier ranges are refused, because the address covers people other than you and no one user can authorize the whole gateway. IPv6 origins are refused too (we cannot yet reputation-check them - run curl -4 qsa.sh).
Is it safe to run a curl command from a website?
For safety and honesty - qsa.sh never asks you to pipe anything into a shell.
What tools does an external port scan use?
naabu 2.6.1 for port discovery, nmap 7.99 with the vulners script for service/version and CVE mapping, and nuclei 3.11.1 with the public nuclei-templates for vulnerabilities and exposures - all open-source. See the exact tools we run.
How many ports does a free external port scan check?
Free is the ~30-second streaming scan (top 1,000 ports, ~2,000 curated checks). Full sweeps all 65,535 ports with ~2,000 high-signal checks, async; Deep adds the complete ~10,500-template set plus our own custom checks, emailed. See Pricing.