Lucene search
+L

DoIP Client

🗓️ 17 Jul 2026 06:42:13Reported by KittySploitType 
kittysploit
 kittysploit
🔗 kittysploit.com👁 3 Views

DoIP Client connects to an automotive DoIP gateway to create a UDS diagnostic session.

Refs
Code
#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""DoIP bind listener — connects to a DoIP gateway and opens a diagnostic session."""

from kittysploit import *
from lib.protocols.doip.constants import (
    DOIP_ACTIVATION_DEFAULT,
    DOIP_DEFAULT_PORT,
    DOIP_TESTER_ADDRESS_DEFAULT,
)
from lib.protocols.doip.doip_client import DoIPClient


def _parse_addr(value, default=0):
    try:
        return int(str(value if value is not None else default).strip() or default, 0) & 0xFFFF
    except ValueError:
        return None


class Module(Listener):
    __info__ = {
        "name": "DoIP Client",
        "description": (
            "Connects to an automotive DoIP (ISO 13400) gateway, performs routing "
            "activation, and creates a session for UDS diagnostic post modules"
        ),
        "author": "KittySploit Team",
        "version": "1.0.0",
        "handler": Handler.BIND,
        "session_type": SessionType.DOIP,
        "protocol": "doip",
        "references": [
            "https://en.wikipedia.org/wiki/Diagnostics_over_IP",
            "ISO 13400-2",
            "ISO 14229-1 (UDS)",
        ],
    }

    rhost = OptString("127.0.0.1", "Target DoIP gateway / ECU host", True)
    rport = OptPort(DOIP_DEFAULT_PORT, "DoIP TCP port", True)
    source_address = OptString("0x0E00", "Tester logical address (hex)", True)
    target_address = OptString(
        "0x0000",
        "ECU logical address (0x0000 = use entity address from routing activation)",
        False,
    )
    activation_type = OptString("0x00", "Routing activation type (0x00=default)", False)
    auto_activate = OptBool(True, "Perform routing activation on connect", True)

    def run(self):
        host = str(self.rhost).strip()
        port = int(self.rport)
        source = _parse_addr(self.source_address, DOIP_TESTER_ADDRESS_DEFAULT)
        target = _parse_addr(self.target_address, 0)
        activation = _parse_addr(self.activation_type, DOIP_ACTIVATION_DEFAULT)
        if source is None or target is None or activation is None:
            print_error("Invalid source_address, target_address, or activation_type")
            return False
        activation &= 0xFF
        timeout = float(self.timeout or 5)
        activate = bool(self.auto_activate)

        print_status(
            f"Connecting to DoIP {host}:{port} "
            f"(tester=0x{source:04X}, target=0x{target:04X})..."
        )
        client = DoIPClient(
            host,
            port,
            timeout,
            source,
            target,
            activation,
        )
        if not client.connect(activate=activate):
            print_error(f"DoIP connection/routing activation failed for {host}:{port}")
            return False

        entity = client.entity_address
        print_success(f"DoIP session established with {host}:{port}")
        print_info(f"  Tester address : 0x{client.source_address:04X}")
        if entity is not None:
            print_info(f"  Entity address : 0x{entity:04X}")
        print_info(f"  Target address : 0x{client.target_address:04X}")
        print_info(f"  Routing active : {client.routing_active}")

        additional_data = {
            "host": host,
            "port": port,
            "source_address": client.source_address,
            "target_address": client.target_address,
            "entity_address": entity,
            "activation_type": activation,
            "routing_active": client.routing_active,
            "timeout": timeout,
            "protocol": "doip",
            "platform": "automotive",
        }
        return (client, host, port, additional_data)

    def shutdown(self):
        return True

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jul 2026 06:42Current
5.8Medium risk
Vulners AI Score5.8
3