Python Dependencies
Somnium requires the following Python packages to function properly:
Core Dependencies
Supporting Libraries
Standard Library Modules
Somnium also uses these Python standard library modules:
socket - Low-level network interface for port scanningtime - Timestamp generationos - File operations and screen clearingre - Regular expression validation for IPs and URLssubprocess - Executing ping commandsplatform - OS detection for cross-platform compatibilitystring - String operations for DGA generationrandom - Random sample selection from threat feeds
Installation
Install all dependencies using pip:
The requirements file in the repository is named requierements.txt (note the spelling). Make sure to reference the correct filename when installing.
Timeout Settings
Somnium uses various timeout configurations to prevent hanging on unresponsive targets:
Socket Timeouts
- Default socket timeout: 5 seconds
- Applies to: IP port scanning, TOR node testing, DGA domain testing
- Configuration:
sock.settimeout(5) in main.py:55, 151, 271
HTTP Request Timeouts
- Default HTTP timeout: 5 seconds
- Applies to: Phishing URL tests, malware distribution tests, cryptomining tests
- Configuration:
timeout=5 parameter in requests.get() calls
Ping Timeout
- Default ping count: 1 packet
- Applies to: Remote Desktop tool URL testing
- Configuration: Single ping packet (
-n 1 on Windows, -c 1 on Linux)
Sample Sizes
Each test module uses different sample sizes for security validation:
Port Testing Configuration
Known Bad IPs & TOR Nodes:
- Ports tested:
80, 22, 443
- Tests per IP: 3 (one per port)
DGA Domains:
- Ports tested:
80, 443
- Tests per domain: 2 (one per port)
DGA Configuration
Domain Generation Algorithm Settings:
- Domain length: 5-15 characters (randomly selected)
- Character set: Lowercase ASCII letters
- TLDs used:
xyz, top, zone, info, biz, gq, tk, club
These TLDs are commonly associated with cybercrime according to Netcraft’s analysis. Exercise caution when testing. Output Files
Somnium generates result files in the current working directory:
IP_Results.txt - Known bad IP test resultsURL_Results.txt - Phishing URL test resultsTOR_Results.txt - TOR exit node test resultsMalware_Results.txt - Malware distribution URL test resultsMining_Results.txt - Cryptomining domain test resultsDGA_Results.txt - DGA domain test resultsRAT_Results.txt - Remote access tool test resultsAgent_Results.txt - Bad user agent test resultsDoH_Results.txt - DNS-over-HTTPS test results
All result files use append mode (a+), so results accumulate across multiple test runs.