Instant external security scan of your own IP | curl qsa.sh
Source Reddit BlueTeam
Discussion
qsa.sh is a service that performs an external security scan of the public IP address from which the user connects. It uses open-source tools like naabu, nmap + vulners, and nuclei to scan open ports, services, and vulnerabilities, streaming results live to the user's terminal. The scan only targets the user's own IP address, with a 15-second abort window before scanning begins to ensure consent. Known carrier-grade NAT, mobile carriers, VPNs, proxies, Tor, and IPv6 addresses are refused to prevent unauthorized scanning. Results are ephemeral and not stored on disk.
r/blueteamsec (opens in a new tab)u/tuxxin0 points0 comments
I built qsa.sh to give you an instant, outside-in security scan of your own public IP straight from your terminal.
You can run it without piping to bash.
curl qsa.sh
What it does: It triggers a real external port and vulnerability scan (using open-source tools like naabu, nmap + vulners, and nuclei) of the public IP you're connecting from, streamed live back to your terminal in about 30 seconds.
How it handles safety & consent:
Only your IP: There is no target input field. You cannot point it at anyone else.
The 15-second abort window: When you run the command, it prints your detected IP and gives you a 15-second grace period (Ctrl-C) to abort before anything is actually scanned.
Refusals: Known CGNAT, mobile-carrier, and detected VPN/Tor/IPv6 origins are refused outright.
Zero retention: The results are entirely ephemeral and streamed live—nothing is written to disk.
Curious to hear what people think.