daemon-sec-lotl

jsonld.ts (5499B)

---

 // Structured data (schema.org JSON-LD) builders. Pure: every function takes
 // what it needs and returns a plain object; Base.astro serialises whatever a
 // page hands it. Kept small on purpose — the goal is a correct WebSite /
 // TechArticle / BreadcrumbList / Dataset graph, not every property Google lists.
 
 import { SOURCE_META, SOURCES } from './taxonomy';
 import type { SourceId } from './taxonomy';
 import type { Technique, Tool } from './techniques';
 
 export type JsonLd = Record<string, unknown>;
 
 export const SITE_NAME = 'DÆMONBins';
 export const SITE_FALLBACK = 'https://lotl.daemon-sec.xyz';
 const GPL = 'https://www.gnu.org/licenses/gpl-3.0.html';
 
 const abs = (site: URL | undefined, path: string) => new URL(path, site ?? SITE_FALLBACK).href;
 
 const publisher = {
   '@type': 'Organization',
   name: 'DÆMON',
   url: 'https://daemon-sec.xyz',
 };
 
 /** Home: the site + its search box (SearchAction → /catalog?q=). */
 export function website(site: URL | undefined): JsonLd {
   const root = abs(site, '/');
   return {
     '@context': 'https://schema.org',
     '@type': 'WebSite',
     '@id': `${root}#website`,
     name: SITE_NAME,
     alternateName: 'the Off-the-Land Almanac',
     url: root,
     publisher,
     license: GPL,
     potentialAction: {
       '@type': 'SearchAction',
       target: { '@type': 'EntryPoint', urlTemplate: `${abs(site, '/catalog')}?q={search_term_string}` },
       'query-input': 'required name=search_term_string',
     },
   };
 }
 
 /** The merged dataset itself — on /credits and the catalog. */
 export function dataset(
   site: URL | undefined,
   counts: { techniques: number; tools: number; bySource?: Record<string, number> },
   commits?: Record<string, string | null | undefined>,
 ): JsonLd {
   const upstream: SourceId[] = SOURCES.filter((s) => s !== 'DAEMON');
   return {
     '@context': 'https://schema.org',
     '@type': 'Dataset',
     '@id': `${abs(site, '/')}#dataset`,
     name: `${SITE_NAME} technique index`,
     description: `${counts.techniques} command references across ${counts.tools} tools, from GTFOBins, LOLBAS, WADComs and LOOBins with DÆMON-authored additions. ATT&CK mappings are included where available.`,
     url: abs(site, '/catalog'),
     license: GPL,
     isAccessibleForFree: true,
     creator: publisher,
     keywords: ['living off the land', 'LOLBins', 'GTFOBins', 'LOLBAS', 'WADComs', 'MITRE ATT&CK', 'privilege escalation'],
     isBasedOn: upstream.map((id) => {
       const s = SOURCE_META[id];
       const sha = commits?.[id.toLowerCase()];
       return {
         '@type': 'Dataset',
         name: s.label,
         url: s.homepage,
         sameAs: s.repo,
         license: GPL,
         ...(sha ? { version: sha } : {}),
       };
     }),
     distribution: [{
       '@type': 'DataDownload',
       encodingFormat: 'application/json',
       contentUrl: abs(site, '/data/techniques.json'),
     }],
   };
 }
 
 /** /catalog and the deck indexes. */
 export function collectionPage(site: URL | undefined, path: string, name: string, description: string): JsonLd {
   return {
     '@context': 'https://schema.org',
     '@type': 'CollectionPage',
     name,
     description,
     url: abs(site, path),
     isPartOf: { '@id': `${abs(site, '/')}#website` },
     about: { '@id': `${abs(site, '/')}#dataset` },
   };
 }
 
 /** Catalog → Source → Tool. */
 export function breadcrumbs(site: URL | undefined, items: { name: string; path: string }[]): JsonLd {
   return {
     '@context': 'https://schema.org',
     '@type': 'BreadcrumbList',
     itemListElement: items.map((it, i) => ({
       '@type': 'ListItem',
       position: i + 1,
       name: it.name,
       item: abs(site, it.path),
     })),
   };
 }
 
 /** One tool page: the binary and its techniques as a TechArticle. */
 export function techArticle(
   site: URL | undefined,
   path: string,
   tool: Tool,
   techniques: Technique[],
   source: SourceId,
 ): JsonLd {
   const s = SOURCE_META[source];
   const caps = [...new Set(techniques.flatMap((t) => t.capability))];
   const mitre = [...new Set(techniques.flatMap((t) => t.mitre || []))];
   const platforms = [...new Set(techniques.flatMap((t) => t.platform))];
   const upstream = tool.references?.find((r) => /gtfobins|lolbas|wadcoms/.test(r)) || s.homepage;
   return {
     '@context': 'https://schema.org',
     '@type': 'TechArticle',
     headline: `${tool.name} — ${s.label}`,
     name: tool.name,
     description: `${tool.name}: ${techniques.length} living-off-the-land technique${techniques.length === 1 ? '' : 's'} from ${s.label}. Commands, MITRE ATT&CK mapping, detection and references.`,
     url: abs(site, path),
     mainEntityOfPage: abs(site, path),
     inLanguage: 'en',
     isPartOf: { '@id': `${abs(site, '/')}#website` },
     articleSection: s.label,
     keywords: [tool.name, ...caps, ...platforms, ...(tool.aliases || [])],
     about: mitre.map((id) => ({
       '@type': 'Thing',
       name: `MITRE ATT&CK ${id}`,
       url: `https://attack.mitre.org/techniques/${id.replace('.', '/')}/`,
     })),
     isBasedOn: upstream,
     license: GPL,
     author: { '@type': 'Organization', name: s.author.replace(/\s*&\s*contributors$/, ''), url: s.homepage },
     publisher,
     ...(tool.created ? { dateCreated: tool.created } : {}),
   };
 }
 
 /**
  * Serialise for an inline <script type="application/ld+json">. `<` is escaped
  * so upstream text (tool descriptions, names) can never close the script tag.
  */
 export function serialize(ld: JsonLd | JsonLd[]): string {
   return JSON.stringify(ld).replace(/</g, '\\u003c');
 }