# safaridriver

> Enable the WebDriver Safari browser API for Selenium testing.

safaridriver is a tool that is used to enable Selenium testing via the macOS WebDriver protocol. Once enabled, the WebDriver API could be abused by attackers to communicate with external servers for command and control or exfiltration purposes.

- Page: https://loobins.io/binaries/safaridriver/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-20
- Tactics: Exfiltration, Command and Control

## Paths

- `/System/Cryptexes/App/usr/bin/safaridriver`
- `/usr/bin/safaridriver`

## Example Use Cases

### Enable safaridriver

The following command can be used to enable the WebDriver Safari browser API. The command must be run as root or with sudo privileges.

```bash
sudo safaridriver --enable
```

- Tactics: Exfiltration, Command and Control
- Tags: safari, selenium

## Detections

- No detections at time of publishing

## Resources

- [About WebDriver for Safari](https://developer.apple.com/documentation/webkit/about_webdriver_for_safari)
- [You Talking To Me?](https://starlabs.sg/blog/2021/04-you-talking-to-me/)

## Acknowledgements

- Chris Ross, Cedric Owens: Farming The Apple Orchards: Living Off The Land Techniques