diggerfamily
[email protected]: ~/diggerfamily

The *digger family

// five command-line diggers, one THUGS(red) bloodline

A small pack of single-purpose CLI tools that all share one habit — they dig. Subdomains, IP addresses, Telegram bot tokens, SNMP agents, packet captures: point one at a target or a pile of data, and it comes back enriched. Built in C, C++ and Go by KawaiiPantsu for THUGS(red), the Danish hacking community — red team, blue team, and plain old OSINT curiosity.

browse the tools GitHub / kawaiipantsu THUGS(red) APT repo
5diggers
3languages
MITlicense
0telemetry
🇩🇰made in dk
$ ls -la /usr/local/bin/*digger

Meet the family

Each tool does one job and does it from a terminal — no dashboards, no accounts, no phoning home. Click through to GitHub for source, releases and full docs.

~/subdigger

subdigger

recon · intel · defend · repeat.
live

Fast, multi-threaded subdomain discovery — certificate transparency, 19 OSINT APIs, wordlists and intelligent bruteforce, with async DNS across up to 1400 threads.

  • crt.sh, AXFR zone transfer, recursive CNAME/NS/PTR follow-up
  • GeoIP, ASN and dangling-DNS / takeover flags on every hit
  • Streams CSV or JSON in real time as results land
$ subdigger -d target.com -t 100 copy
Language
C · MIT
Install
Source only (not yet packaged)
subdomain-enumdnscert-transparencybug-bounty
source ↗ on thugs.red ↗
~/ipdigger

ipdigger

every IP in a file, fully enriched.
live

Point it at a log, a dump, or any pile of text — it pulls out every IPv4/IPv6 address and enriches each with rDNS, WHOIS, GeoIP, TLS certs, ASN and threat intel.

  • Attack detection: DDoS, password-spray, port-scan, brute-force patterns
  • AbuseIPDB scoring, Tor exit nodes, THUGS(red) TI lists
  • GeoJSON export, ASCII tables or JSON — multi-threaded for 1GB+ logs
$ sudo apt install ipdigger copy
Language
C++ · MIT
Install
apt install ipdigger (amd64 · arm64 · i386)
iposintthreat-intelgeoip
source ↗ on thugs.red ↗
~/telegramdigger

telegramdigger

bot tokens don't lie, once you ask.
live

The Telegram Bot API from a terminal, built for OSINT: hand it a leaked or found bot token, grade what it can reach, then act — pull messages or take the bot down.

  • Token validation, bot info, admin-rights and webhook inspection
  • Send messages (Markdown/HTML), silent mode, link-preview control
  • Token annotation and bulk validation from a file
$ sudo apt install telegramdigger copy
Language
C++ · MIT
Install
apt install telegramdigger (amd64)
telegramosintbot-apipentest
source ↗ on thugs.red ↗
~/snmpdigger

snmpdigger

discover · graph · inform.
live

A fully keyboard-driven full-screen TUI: walks the MIB tree live, fingerprints devices, graphs any counter as a braille chart, and sweeps a CIDR or a whole ASN for SNMP agents.

  • SNMP v1 / v2c / v3, offline MIB catalog, live trap/inform listener
  • Summary tab: hardware, routing, ARP/LLDP, RIPEstat geolocation
  • Single static Go binary, zero runtime dependencies
$ snmpdigger discover 192.168.1.0/24 copy
Language
Go · MIT
Install
Source only (not yet packaged)
snmptuinetworkdiscovery
source ↗ on thugs.red ↗
~/pcapdigger

pcapdigger

packets tell stories. we dig deeper.
wip

Loads a pcap/pcapng file and builds security-architect and executive-level reports: flow reconstruction, IOC extraction, TLS/DNS/ARP inspection, beacon and exfil detection, plus an SVG flow diagram.

  • Credential and malformed-packet scanning, port and beacon analysis
  • JSON / CSV / Markdown reports, generated SVG network diagram
  • Single static Go binary — nothing extracted or executed, ever
$ pcapdigger analyze -f capture.pcap copy
Language
Go
Install
Source only — in active development
pcapnetwork-forensicsiocblueteam
source ↗
$ pstree -digger

The family tree

One community, one naming convention, one shared habit: point it at something and dig until it gives up its data.

pstree -digger 
THUGS(red) ── Danish Hacking Community
  └── KawaiiPantsu ── Security Architect, Copenhagen 🇩🇰
        └── *digger ── "if it can be dug, it will be dug."
              ├── subdigger      [C]    → domain in, subdomains out
              ├── ipdigger       [C++]  → file in, IPs + intel out
              ├── telegramdigger [C++]  → bot token in, exposure out
              ├── snmpdigger     [Go]   → CIDR in, SNMP agents out
              └── pcapdigger     [Go]   → pcap in, IOCs + report out
$ whoami --verbose

Who's digging

handleKawaiiPantsu (Dave)
roleSecurity Architect / Analyst
based_inCopenhagen, Denmark 🇩🇰
communityTHUGS(red) — Danish Hacking Community
i_dored teaming, packet forensics, OSINT tooling
i_believe"the best tool is the one you can read the source of"
languagesC, C++, Go, PHP, bash
licenseMIT, across the whole family
githubgithub.com/kawaiipantsu

Every tool in this family started the same way: a real assessment, a pile of logs, or a leaked credential that needed digging through by hand — so a small, sharp CLI got written to do it properly instead. No accounts, no cloud dashboards, no telemetry phoning home. Just a static binary (or a make away from one) that does one job.

These are offensive- and defensive-security tools. Use them on systems and data you're authorized to test — your own infrastructure, a client engagement with a signed scope, a CTF, or your own OSINT research. THUGS(red) builds for the trenches, not for trouble.

Want the full toolbox, not just the diggers? THUGS(red) runs an APT repository, a tools index, writeups, advisories and a Discord community — all linked from thugs.red.