Prerequisites
Before installing Somnium, ensure you have the following:Python 3.x
Somnium requires Python 3.6 or later. Check your Python version:pip package manager
Verify pip is installed:Network access
Somnium requires outbound internet access to:- Download threat intelligence feeds
- Connect to malicious IPs and domains for testing
Installation steps
Install dependencies
Install the required Python packages:This installs the following dependencies:
- requests - HTTP library for downloading threat feeds and testing URLs
- tqdm - Progress bar visualization for tests
- art - ASCII art generation for the CLI interface
- colorama - Cross-platform colored terminal output
The requirements file is named
requierements.txt (note the spelling) in the repository.System requirements
- Operating System: Linux, macOS, or Windows
- Python: 3.6 or higher
- RAM: 512MB minimum
- Disk Space: 100MB for dependencies and logs
- Network: Outbound internet access (HTTP/HTTPS)
Permissions
Somnium creates log files in the current working directory:IP_Results.txt- Known bad IP connection testsURL_Results.txt- Phishing URL testsTOR_Results.txt- TOR exit node testsMalware_Results.txt- Malware distribution URL testsMining_Results.txt- Cryptomining domain testsDGA_Results.txt- Domain Generation Algorithm testsRAT_Results.txt- Remote access tool connection testsAgent_Results.txt- Bad user-agent testsDoH_Results.txt- DNS over HTTPS tests
Network configuration
Configure logging
Enable logging on your security devices before running tests:
- Firewall: Enable connection logging for denied and allowed traffic
- IDS/IPS: Configure alerts for signature matches
- Proxy: Enable URL filtering logs
- SIEM: Ensure you’re ingesting logs from all security devices
Note the test system IP
Identify the IP address of the system running Somnium:You’ll use this IP to filter logs and correlate test activity.
Troubleshooting
ModuleNotFoundError
If you seeModuleNotFoundError: No module named 'requests' or similar:
Connection timeouts
Many malicious IPs and URLs in threat feeds are offline. This is expected behavior. Somnium logs both successful and failed connections - the goal is to verify your security tools detect the attempts.Permission denied writing logs
Python version issues
Ifpython3 is not found but you have Python 3 installed: