qsa.sh
Run an external port and vulnerability scan against your outbound public IP with one command; results stream back in about 30 seconds.
About qsa.sh
qsa.sh is a one-command security scanning service that launches a real external port and vulnerability scan against the public IP you are currently connecting from, streaming results to your terminal in about 30 seconds with nothing to install. The scan targets only your connection source; there is no target field. Known CGNAT, carrier-network, and connections identified as proxy, VPN, or Tor are rejected, and only IPv4 is supported. A 15-second abort window is provided before scanning; continuing counts as authorization. Results are streamed in real time only and are not written to disk; every scan has a time limit and terminates automatically. Free, Full, and Deep scan depths range from a quick check of common ports to a deep full-port scan with complete nuclei templates; the highest tier can send the full report by email.
Best for
Best use cases
Quickly check public port exposure on a server before or after launch
Verify that firewall rules have closed the intended ports
Get an overview of open ports, service versions, and vulnerability severity
Temporarily obtain an external security scan with no retained results
Features
One-command external scan
Run one command to scan the public IP of the current connection using naabu, nmap, and nuclei for port and vulnerability checks, with live output for about 30 seconds.
Three scan depths
The Free tier covers the top 1,000 ports and runs about 2,000 nuclei checks; Full and Deep scan all 65,535 ports, while Deep enables about 10,500 nuclei templates plus custom templates.
Immediate results, no retention
Results are streamed in real time only and not written to disk; scans have a time limit and terminate automatically, and are cancelled when a disconnect is detected.
Built-in authorization guardrails
A 15-second Ctrl-C abort window is provided before scanning as a confirmation gate; CGNAT, carrier, proxy, VPN, Tor, and IPv6 sources are rejected.
Pros
- Start a scan with one command, with nothing to install
- View scan results live in the terminal in about 30 seconds
- Results are not written to disk; only short-lived rate-limit counts are kept
- A 15-second abort window before scanning provides an explicit authorization gate
Cons
- IPv4 only; known CGNAT, mobile-carrier networks, and connections identified as proxy, VPN, or Tor are rejected
- No target field; only the public IP from which you make the request can be scanned