The same repo includes IPv6-specific DNS response injection/tampering attack code (folders '4_v6_注入' and '5_v6_篡改': fakedns6/attack.go) plus a custom CoreDNS fork ('ohmydns.go') carrying bespoke atk (attack) and prober (probe53/qname) plugins used for IPv6 DDoS and DNS-probing research -- a purpose-built offensive DNS toolkit distinct from the production TSG stack.

A 2023 MESA Lab monthly report describes the 'TF' project's active-defense work: test cases for serial ('串联') HTTP hijack/tamper and parallel ('并联') DNS race-injection ('DNS抢答'), performance tuning that scaled active-defense capacity from 3 to 5 units, converting two existing TSG boxes to active-defense mode, and rewriting the active-defense flow-control logic to no longer depend on sapp.

A 2023 MESA Lab monthly report (author and advisor names redacted) describes the 'TF' project's active-defense work: testing serial HTTP hijack/tamper and parallel DNS race-injection ('DNS抢答'), scaling active-defense compute boards from 3 to 5, converting two existing TSG units to active-defense mode, and rewriting active-defense flow control to no longer depend on sapp. NOTE: this content is nearly identical to the existing corpus finding 2026-084104-tf-active-defense (artifact 084104aa052e) -- likely the same underlying document ingested under two different artifact IDs; flagged for dedup review.

The same ADC/TSG-OS installation guide's built-in factory acceptance test ("tsg-diagnose-oneshot") enumerates the product's certified MITM/content-manipulation actions as standard, tested features of every deployment: SSL interception with expired/self-signed/untrusted-root cert handling, and both SSL and HTTP proxy policies supporting redirect, block, replace, hijack, and insert actions, plus DNS request handling with drop and A/AAAA redirect (including TTL-range variants). This is vendor self-documentation, not inferred behavior.

An IIE 'attack script' repo (zhuyujia/yydns) contains dedicated, documented modules for injecting fake DNS-over-HTTPS and DNS-over-TLS responses (fake_DoH.py with a 'DoH数据注入' writeup, fake_DoT.py/dot_stub.py with a 'DoT数据注入' writeup) -- direct evidence of active internal research into defeating encrypted DNS transports via response injection, not just plain-DNS spoofing.

TSG's firewall 'Deny' security-policy action is confirmed implemented via three interchangeable mechanisms: TCP RST injection, forged HTTP 404 response-page injection, and DNS-redirect. Confirmed via commits to MESA_Platform/sapp and tsg/tsg-os-buildimage GitLab repos (git.mesalab.cn).

A MESA Lab repo (shihaoyue/yy_deploy_script) contains an organized suite of active attack tooling specifically targeting encrypted DNS: DoH/DoT downgrade attacks, DoH/DoT DDoS including a CVE-2024-4487 (HTTP/2 Rapid Reset) exploit script, IPv6 DNS response spoofing/injection (fakedns6 using forged-source-address "saddns"), a DNSSEC-downgrade proxy, DNSSEC-DDoS tooling, and an active DNS-fingerprinting probe pair (fpdns_client/fpdns_server under a folder named "TargetGZ"). This is direct evidence of GFW-adjacent R&D that specifically attacks the encrypted-DNS protocols (DoH/DoT) circumvention tools often rely on for resolver privacy.