qsa.sh: Complete an External Server Security Scan with a Single curl Command

What is qsa.sh

In the server security space, ops engineers and developers often face an awkward problem: we know exactly what we've deployed on our internal network, but it's hard to intuitively understand "what can the internet actually see of my host?" The essence of this problem lies in the visibility of the "attack surface" — ports are the logical entry points for network communication. TCP/UDP protocols define a total of 65,535 port numbers, and each externally open port could become a potential entry point for attackers.

The attack surface refers to the sum of all entry points in a system that can be accessed and exploited externally — the larger the attack surface, the higher the potential risk. At the port level, IANA (Internet Assigned Numbers Authority) divides ports into three ranges: 0-1023 are Well-Known Ports, used by system-level services such as HTTP on port 80, HTTPS on 443, and SSH on 22; 1024-49151 are Registered Ports for application use, such as MySQL on 3306, Redis on 6379, and PostgreSQL on 5432; 49152-65535 are Dynamic/Private Ports. Attack Surface Management (ASM) has evolved into an independent security sub-field in recent years, with Gartner listing it as an emerging technology. Representative vendors include Censys, Shodan, and CrowdStrike. qsa.sh can be viewed as a lightweight personal-grade implementation in this space.

Many security incidents stem from administrators not knowing that certain ports are still listening externally — for example, a Redis port 6379 used for debugging left without a password, a test environment database port accidentally exposed, Docker API port 2375 without access control, or Elasticsearch port 9200 directly open to the public internet. Multiple major data breaches in 2023 involved unauthorized services exposed to the public internet.

qsa.sh was created precisely to solve this pain point as a minimalist external security scanning tool that compresses the complex scanning workflow into a single command.

Simply execute curl qsa.sh in your terminal, and you'll receive an external security scan report of your server's public IP in approximately 30 seconds. The entire process requires no account registration, and scan results are not stored — truly a "use it and go" experience. It's worth noting that the curl qsa.sh usage pattern is fundamentally different from the commonly seen curl ... | sh pattern in the security community (downloading and executing scripts). The latter has sparked widespread controversy because users executing remote code without reviewing the script content face supply chain attack risks. qsa.sh's design has the server execute the scan and stream results back to the terminal for display — the user doesn't execute any unknown code locally, making it a more prudent security model.

After launching on Product Hunt, the product garnered 111 upvotes and 17 comments, ranking 17th that day, categorized under Developer Tools, Business Intelligence, and Security.

Technical Principles: A Combination of Three Open-Source Scanning Engines

The core value of qsa.sh lies in integrating several mature open-source scanning tools from the security community into an out-of-the-box pipeline. Understanding its technical composition means understanding exactly what it does.

How the Three Scanning Engines Collaborate

According to the product description, qsa.sh chains together three well-known tools:

• naabu: A high-speed port scanner from ProjectDiscovery, responsible for quickly detecting which ports are open on the target host. Written in Go, naabu uses SYN scanning (half-open connection scanning) — it doesn't complete the full TCP three-way handshake but only sends a SYN packet and determines port status based on the response, dramatically reducing scan time.

  To understand the elegance of SYN scanning, you need to understand the complete TCP three-way handshake process: during normal connection establishment, the client sends a SYN packet, the server replies with SYN-ACK, and the client sends an ACK to complete the connection. SYN scanning only performs the first step: after sending SYN, if a SYN-ACK is received the port is determined to be open, if RST is received the port is determined to be closed, and then immediately sends RST to disconnect without completing the third handshake step. This "half-open" characteristic means the target system typically won't record connection logs at the application layer (since the connection was never truly established), hence it's also called "Stealth Scan." However, against modern Intrusion Detection Systems (IDS), SYN scanning is no longer truly "stealthy," but its speed advantage remains significant.

  ProjectDiscovery is a highly regarded open-source organization in the security community, founded around 2020 by security researchers @ice3man and @ehsandeep. Their product matrix covers the complete attack chain from asset discovery (subfinder), port scanning (naabu), HTTP probing (httpx), vulnerability detection (nuclei), to automation orchestration (notify). This toolchain has become standard equipment for Bug Bounty hunters and enterprise security teams, with combined GitHub stars exceeding 100,000. ProjectDiscovery's design philosophy emphasizes the "Unix Philosophy" — each tool does one thing well, and complex workflows are achieved through pipeline composition.

• nmap + vulners: nmap (Network Mapper) is the "Swiss Army knife" of network scanning, born in 1997 and developed by Gordon "Fyodor" Lyon, still the most widely used scanning tool in the security industry today. It identifies the services running behind ports and their version numbers — by analyzing service banner information and protocol fingerprints (-sV parameter), it precisely identifies software names and versions. nmap's fingerprint identification relies on a massive community-maintained database (nmap-service-probes) containing response pattern characteristics for thousands of services.

  NSE (Nmap Scripting Engine) is the revolutionary feature introduced in nmap 4.x. It embeds a Lua script interpreter, allowing users to write and load custom scripts to extend nmap's functionality. NSE scripts are categorized by purpose: auth (authentication testing), brute (brute force), vuln (vulnerability detection), discovery (information discovery), etc. vulners is an NSE script in the vuln category that cross-references identified service version information against the Vulners.com vulnerability database in real-time, returning a list of known CVE vulnerabilities and their CVSS scores for that version. Vulners.com aggregates vulnerability intelligence from multiple sources including NVD, vendor security advisories, and Exploit-DB, making it one of the largest public vulnerability aggregation platforms.

  This "version fingerprint + vulnerability database matching" approach cannot discover zero-day vulnerabilities but has extremely high coverage for known vulnerabilities. Its limitation is that if a service has banner hiding configured or returns false version numbers, it may lead to false positives or false negatives.

• nuclei: Also from ProjectDiscovery, this vulnerability scanning engine's core design concept is "template-driven" — each detection rule is defined as a YAML-format template file describing what request to send, what response to expect, and what conditions to match. A typical nuclei template contains: metadata (id, name, severity level, CVE number), request definition (HTTP method, path, headers, body), matchers (response matching rules based on status codes, regular expressions, or keywords), and extractors (extracting specific information from responses). This declarative definition allows even security personnel without programming skills to write and understand detection rules.

  The community-maintained nuclei-templates repository contains over 8,000 templates covering CVE vulnerability detection, default credential testing, sensitive information disclosure, misconfiguration discovery, and more. After a new vulnerability is publicly disclosed, community members typically submit corresponding detection templates within 24-48 hours. This "crowdsourced security intelligence" model makes nuclei one of the fastest-responding vulnerability detection tools. nuclei also supports a "workflow" concept that dynamically determines which templates to execute based on previous scan results, enabling intelligent scan orchestration.

The logic of this combination is very clear: first "find the doors" (port scanning), then "see what's behind the doors" (service version identification), and finally "check if the locks have vulnerabilities" (CVE vulnerability matching). The three progress layer by layer, constituting a complete external asset exposure assessment.

Here it's worth explaining the CVE system: CVE (Common Vulnerabilities and Exposures) is a globally unified vulnerability numbering system maintained by MITRE Corporation, where each confirmed security vulnerability is assigned a unique identifier (e.g., CVE-2024-XXXXX). CVE assignment isn't completed by MITRE alone but coordinated through over 300 global CNAs (CVE Numbering Authorities), including major software vendors like Microsoft, Google, and Red Hat. As of 2024, the CVE database has cataloged over 250,000 vulnerability records, with the annual number of new additions continuing to rise (approximately 29,000 added in 2023).

Complementing CVE is CVSS (Common Vulnerability Scoring System), which quantifies vulnerability severity on a 0-10 scale. CVSS has now iterated to version 4.0, with scoring dimensions including attack vector (Network/Adjacent/Local/Physical), attack complexity, required privilege level, user interaction requirements, and impact scope (Confidentiality/Integrity/Availability). Typically, CVSS 9.0 and above is considered "Critical," and 7.0-8.9 is "High." The scanning engines behind qsa.sh rely on this standardized system to determine whether target services have known security risks.

Examining Your Server from an Attacker's Perspective

qsa.sh's design philosophy is "See exactly what the internet sees of your host" — letting you see your host's true state from the internet's perspective. This is fundamentally different from traditional internal security audits: internal audits are based on your understanding of the system, while external scanning completely simulates an attacker's probing from the public internet, capable of discovering ports and services you thought were closed but are actually still externally exposed.

This external perspective is called "black-box testing" or "the reconnaissance phase of external penetration testing" in security methodology. In the MITRE ATT&CK framework, an attacker's first step is precisely "Reconnaissance" (TA0043), including actively scanning target IP addresses, ports, services, and vulnerability information. qsa.sh essentially lets you complete this step before an attacker does.

The information security field commonly uses "Defense in Depth" to describe multi-layered protection strategies. This concept originates from military science and in cybersecurity refers to deploying independent security controls at multiple layers (network boundary, host, application, data) so that when a single defensive line is breached, other lines still exist. External scanning (like qsa.sh) simulates the attacker's perspective, detecting exposure reachable from the public internet; while internal security audits focus on host configuration, permission management, log monitoring, and other internal dimensions. The two are complementary rather than substitutive. For example, a server might hide all high-risk ports through a firewall (showing good external scan results) but still have unpatched local privilege escalation vulnerabilities internally. A complete security system requires organically combining external scanning, internal auditing, penetration testing, security monitoring, and other measures.

Free vs. Paid Plans Comparison

qsa.sh adopts a clear tiered business model, with different tiers corresponding to different scanning depth capabilities.

Free Scan: Quick Security Checkup

The free version provides live scanning, streaming results directly to the terminal. "Streaming output" means the server uses HTTP chunked transfer encoding or a similar mechanism — as soon as new results emerge during scanning, they're immediately pushed to the client terminal for display rather than waiting for all scanning to complete before returning everything at once. This approach gives users real-time feedback, making the experience closer to a local command-line tool.

It's suitable for quickly checking common ports and typical vulnerabilities, and is the starting point for the vast majority of users. "Common ports" typically refers to naabu's default Top 100 or Top 1000 port list — this list is based on the most frequently appearing port numbers from nmap's years of statistical data, covering the majority of commonly used services. The no-account, no-storage design also lowers the barrier to entry and privacy concerns.

Advanced Value of Pro and Deep Paid Plans

• Pro (Paid): Covers all 65,535 ports and uses async scanning. Traditional synchronous scanning sends probe packets to each port sequentially and waits for responses — scanning all 65,535 ports one by one takes an extremely long time (assuming 1-second timeout per port, a full port scan would take over 18 hours). Async scanning decouples "sending probe packets" and "receiving responses" into two independent processes: the sender transmits SYN packets to all target ports at extremely high rates (up to hundreds of thousands of packets per second), while the receiver asynchronously listens for all returning SYN-ACK or RST packets. This approach can complete a full port scan in seconds.

  Representative tools include masscan (developed by Robert Graham, claiming to "scan the entire internet in 6 minutes") and zmap (developed by a University of Michigan research team). The core technical breakthrough of these tools is bypassing the operating system's TCP/IP protocol stack to construct and send raw packets directly in user space, avoiding the performance bottleneck of the kernel protocol stack. Full port scanning means not missing any potentially overlooked obscure ports — many administrators deploy sensitive services on non-standard high ports to achieve "Security through Obscurity," and full port scanning effectively defeats this pseudo-security strategy. Async processing dramatically improves efficiency for large-scale scanning.

• Deep (One-time Payment): Officially described as "the full nuclei firehose" — enabling the complete nuclei template library for deep vulnerability mining, with results delivered via email. The "firehose" mode means enabling all 8,000+ templates for scanning, with detection depth far exceeding the default curated subset (which typically only enables critical and high severity level templates), but scan time extends from dozens of seconds to tens of minutes or longer. The complete template library includes medium/low/info level detections, such as missing HTTP security headers, directory traversal, information disclosure endpoints, outdated TLS versions, etc. While these aren't critical vulnerabilities, they're still important clues for security hardening. This approach is suitable for scenarios requiring thorough vulnerability investigation, and since it takes longer, results are no longer delivered via real-time terminal output.

The rationale behind this tiered design is: free scanning addresses "quick checkup" needs, Pro addresses "full port coverage" needs, and Deep addresses "deep vulnerability mining" needs — users can choose based on their actual security level. From a business model perspective, this is also a typical practice of the "Free → Pro → Enterprise" tiered strategy common in developer tools.

Value and Limitations of qsa.sh

The Real Value Behind the Minimalist Experience

The most compelling aspect of qsa.sh for developers is that it simplifies the tedious process of manually installing, configuring, and chaining multiple tools into a single curl command. If you were to manually build an equivalent scanning pipeline, you would need to: install the Go environment to compile naabu, install nmap and the vulners script, install nuclei and update the template library, write shell scripts to chain the inputs and outputs of all three together, and handle various dependency conflicts and version compatibility issues. This process takes at least half an hour even for experienced Linux ops engineers.

For small-to-medium teams, independent developers, and individual site owners, this kind of "zero-configuration" security self-check tool is extremely attractive — you don't need to be a security expert to quickly understand your server's exposure.

Results in 30 seconds, no registration required, results not stored — these three points together constitute a low-friction trust model that particularly meets terminal users' dual expectations for privacy and efficiency. The "results not stored" aspect is especially important given the increasingly strict data privacy regulations (such as GDPR and China's Personal Information Protection Law) — scan results may contain technical fingerprint information about the server, which if retained by third parties could be exploited by attackers.

Capability Boundaries to View Rationally

As an automated scanning tool, qsa.sh has its inherent limitations. It primarily detects based on known CVEs and public templates and cannot replace manual penetration testing's ability to discover business logic vulnerabilities, permission configuration errors, and other deep issues. Business logic vulnerabilities refer to flaws in application business process design — for example, price manipulation on e-commerce platforms, unauthorized access to others' orders, verification code reuse, etc. These vulnerabilities cannot be discovered through port scanning or version comparison and must rely on understanding of business context and targeted testing.

It provides a "snapshot of asset exposure" rather than complete security assurance. It's worth noting that the CVE system only covers "publicly disclosed" vulnerabilities — zero-day vulnerabilities (0-days) and business logic flaws are outside its coverage. Zero-day vulnerabilities refer to security flaws that have been discovered and exploited by attackers but have not yet been publicly disclosed or assigned a CVE number by the security community — during this "window period" in the vulnerability lifecycle from discovery to disclosure, defenders are virtually powerless. This also means that an "all green" scan result from qsa.sh does not equal absolute security.

Additionally, automated scanning has inherent issues with "False Positives" and "False Negatives." False positives mean the tool reports vulnerabilities that don't actually exist (e.g., version number matches but has actually been patched), while false negatives mean the tool fails to discover vulnerabilities that actually exist. Scan results should serve as the starting point for security assessment, not the endpoint — critical findings still require manual verification.

Furthermore, it must be especially emphasized: such tools should only scan IPs you own or are authorized to scan. The product name's emphasis on "your own IP" repeatedly reinforces this compliance premise. Initiating port scans against others' servers may cross legal boundaries in many jurisdictions. For example, in China, the Cybersecurity Law and Article 285 of the Criminal Law have explicit legal provisions regarding unauthorized intrusion into computer information systems; in the United States, the CFAA (Computer Fraud and Abuse Act) similarly classifies unauthorized computer access as criminal. Even if only port scanning is performed without actually exploiting vulnerabilities, it may constitute illegal behavior in specific contexts.

Conclusion

qsa.sh represents an increasingly popular product philosophy: wrapping mature open-source capabilities in an extremely simple entry point, enabling the value of professional tools to reach a broader user base. This model has many successful precedents in the developer tools space — Vercel for frontend deployment, Supabase for database services — all abstracting complex infrastructure into simple developer experiences.

For developers who want to quickly understand "what the internet sees of them," a single curl qsa.sh command might be the first step in putting security awareness into practice. It's not an all-in-one security solution, but as the first line of defense for daily server security self-checks, its cost-effectiveness and ease of use are quite impressive. It's recommended to incorporate it into regular security check workflows — for example, after each new service deployment, after modifying firewall rules, or as a security checkpoint in CI/CD pipelines — to ensure the exposure surface always remains within expected bounds.