qsa.sh

Product Introduction

1. Definition: qsa.sh is a cloud-based, external attack surface management (ASM) and vulnerability assessment tool delivered entirely via a single command-line interface command (curl qsa.sh). It functions as a server-side port scanner and vulnerability scanner, utilizing a stack of open-source security tools (naabu, nmap + vulners, nuclei) to perform a live, network security audit of the user's own public IP address with zero installation on the client side.
2. Core Value Proposition: It solves the problem of needing immediate, frictionless external visibility into one's own internet-facing systems. It eliminates the setup time, installation dependencies (Python, Go, libpcap), and storage concerns associated with traditional scanning tools, providing a rapid, ephemeral external security scan directly in the terminal to answer the question: "What does the internet see of my host?"

Main Features

1. Zero-Install, One-Command Execution:

   • Technical Description: The service is invoked by piping or running a simple cURL command (curl qsa.sh, or curl https://qsa.sh for an encrypted session). The scanner infrastructure is entirely server-side. The user's machine acts only as a display for the streamed output. This bypasses the need to install complex toolchains (e.g., Go, Rust) or manage local dependencies like libpcap, which are prerequisites for tools like naabu and nmap. The scan is executed from remote scanner nodes, providing an outside-in perspective on the target IP.
   • How it Works: The user's HTTP/HTTPS connection is used to determine their public IPv4 address. This address is validated against known Carrier-Grade NAT (CGNAT) ranges and proxy/VPN/Tor exit node lists. Upon validation, the server initiates a scan against that specific address.

2. Authorization Gate & Ephemeral Data:

   • Technical Description: A mandatory 15-second pre-scan window pauses execution, displaying a warning banner that shows the target IP. The user must allow the timer to expire without pressing Ctrl-C to proceed. This acts as the primary consent mechanism. Critically, the service claims no results are stored. Only short-lived rate-limit counters are kept to prevent abuse. The scan is time-bounded and self-terminates; if the user disconnects (e.g., closes the terminal), the server cancels the running scan processes.
   • How it Works: The initial request returns a 15-second delay. The user's failure to interrupt this delay is interpreted as authorization. Once initiated, the scan process has a hard execution time cap. The streaming session is terminated upon user disconnect or scan completion.

3. Tiered Scanning Depth with Live Streaming:

   • Free ($0): A live, interactive scan lasting approximately 30 seconds. It probes the top 1,000 TCP ports using naabu, then performs service and version detection via nmap, and cross-references results against the vulners database for CVE matching. Approximately 2,000 high-signal nuclei templates are run. Output is streamed live to the terminal, showing open ports, versions, severity counts, and the top 3 CVEs.
   • Full ($5/mo): An async scan of all 65,535 TCP ports. It uses the same ~2,000 curated nuclei templates. Because scanning all ports takes longer, results are delivered asynchronously (e.g., via a callback link or email). Includes full findings and remediation guidance.
   • Deep ($7 one-time): A comprehensive, async scan of all 65,535 TCP ports plus the entire ~10,500-template nuclei library, including custom templates. This is described as the "raw firehose" and takes approximately 13-16 minutes. Results are emailed as a complete report.
   • How it Works: The chosen tier dictates the C2 profile (port list, nuclei template set, and timeout) sent to the scanner nodes. The Free tier prioritizes speed (common ports, fast checks), while the Deep tier prioritizes depth (full port scan, exhaustive CVE search).

Problems Solved

1. Pain Point: Security Blind Spot and Access Barrier. System administrators, DevOps engineers, and security analysts often need a quick external perspective to verify firewall rules, detect accidentally exposed services (e.g., SSH, RDP, databases), or check for known vulnerabilities without the overhead of installing and configuring a full security toolchain (e.g., Nmap, Nuclei). Traditional methods are often blocked by corporate proxies or lack the necessary dependencies on bare-metal machines.
2. Target Audience:
   • Individual Server Administrators & Sysadmins: who manage a few VPS or cloud instances and need a quick sanity check on their exposed ports.
   • DevSecOps Engineers: who want to integrate a quick external scan into a pre-deployment checklist or incident response workflow.
   • Ethical Hackers & Penetration Testers: who need a rapid "fingerprint" of a target they are authorized to scan before a deeper engagement.
   • Home Lab Enthusiasts: who want to ensure their home network isn't unexpectedly exposing services to the public internet.
3. Use Cases:
   • Post-Deployment Security Check: Immediately after provisioning a new cloud server, a user can run curl qsa.sh to verify that only the intended ports (e.g., 80, 443, 22 from a specific IP) are open.
   • Rapid CVE Assessment: To check if a newly disclosed critical CVE (e.g., Log4j, ProxyShell) affects their public-facing services by seeing if the version detected by nmap matches the vulnerable version range.
   • Network Change Validation: After changing a firewall rule or an application configuration, an admin can run the scan to confirm the change had the desired external effect.

Unique Advantages

1. Differentiation: qsa.sh differentiates itself from traditional tools (Nmap, Masscan) and cloud-based scanners (Shodan, Censys, Qualys) through its extreme frictionlessness. Traditional tools require installation and are executed from the user's machine, which may be behind a restrictive firewall. Cloud scanners often require creating an account, installing an agent, and registering the target. qsa.sh requires neither an account nor an agent. It acts as a "scan utility," analogous to dig or curl themselves, but for security visibility.
2. Key Innovation: The core innovation is the inversion of control and the policy-enforced authorization model. The user cannot specify a target IP; the system determines the target from the connection and enforces scanning rules (e.g., refusing CGNAT, proxies). This design is a deliberate architectural choice to solve the legal and ethical ambiguity of external scanning. It turns a potentially dubious activity (scanning an IP you don't own) into a self-service tool for legitimate self-assessment. The ephemeral nature of the results further aligns with a trust-optional model.

Frequently Asked Questions (FAQ)

1. How does QSA.sh prevent me from accidentally scanning someone else's IP? QSA.sh has no target input field. The scan target is automatically detected as the public IPv4 address from which your curl request originates. Before the scan proceeds, a 15-second warning window displays this detected IP, giving you a final opportunity to cancel with Ctrl-C if it is incorrect or if you are not authorized to scan it. Known Carrier-Grade NAT (CGNAT) and mobile-carrier IP ranges are also blocked by the system because they are shared by multiple users.
2. What happens to the data from my scan? Is my IP address and vulnerability list stored? The scan results are ephemeral and streamed live to your terminal only. The service states it does not write the results to any persistent disk storage. Only short-lived rate-limit counters are kept to prevent abuse of the free tier. As soon as you disconnect or the scan completes, the temporary data is discarded.
3. Can I use QSA.sh to scan my home server if my ISP uses Carrier-Grade NAT (CGNAT)? No. QSA.sh explicitly refuses connections from known CGNAT ranges and mobile-carrier networks. The ethical and legal basis is that no single individual can be authorized to scan a public IP shared by many customers. The tool is designed for users who have a dedicated, routable public IPv4 address, typically from a business-class internet connection or a cloud hosting provider.
4. What are the main differences between the Free, Full, and Deep tiers for QSA.sh? The Free tier is a live scan of the top 1,000 TCP ports with a curated subset of nuclei checks, taking 30 seconds. The Full tier ($5/mo) scans all 65,535 TCP ports asynchronously with the same curated nuclei set. The Deep tier ($7 one-time) also scans all ports but uses the entire nuclei template library (10,500 templates), including custom QC templates, for maximum vulnerability coverage, with results emailed as a comprehensive report.
5. How long does a QSA.sh scan take, and can I run it on a server without any pre-installed tools? The Free live scan is designed to complete in approximately 30 seconds. It requires no pre-installed tools on your server. The only dependency is curl, which is installed on virtually all Unix-like operating systems (Linux, macOS). The scan is executed entirely on QSA.sh's remote infrastructure.