识别并修复 Web 应用中的 XSS 漏洞

什么是跨站点脚本?

跨站点脚本 (XSS) 是一个代码注入漏洞,当开发人员在将用户输入插入 HTML 模板之前未对用户输入进行足够好的审查时,就会在处理 HTML 的应用程序中发生该漏洞。它允许攻击者将任意 JavaScript 代码插入模板并在用户的上下文中执行它:

跨站点脚本在上图中,开发人员未能清理“姓氏”div 的内容,这导致用户能够通过操纵其姓氏来包含恶意脚本。

XSS 常见吗?

尽管许多框架和库为用户提供了摆脱XSS的所有必要工具,但这仍然是Web应用程序中最常见的漏洞之一。它一直出现在 OWASP 顶级 Web 应用程序安全风险列表中,并在 40 年针对欧洲和北美大型企业的 2019% 在线网络攻击中使用。根据HackerOne的说法,XSS漏洞是在漏洞赏金程序中发现的最常见的漏洞类型。

在哪里可以发现 XSS 漏洞?

有两种类型的跨站点脚本:

客户端 XSS
服务器端 XSS
最常见的XSS。它发生在客户端(在浏览器或桌面应用程序中),并且是在将用户提供的数据插入 DOM 之前未正确清理用户提供的数据的结果。 这是非常罕见的,但可能。当服务器将 HTML 文件转换为其他文档(很可能是 PDF)并且库不会将其执行的代码类型列入白名单时,就会发生这种情况。您可以在HackTricks上阅读有关动态PDF漏洞的信息。

XSS真的那么危险吗?

简单地说,这是一场灾难。下面列出了攻击者在能够利用客户端上的 XSS 漏洞时可以执行的操作:

  • 远程代码执行(浏览器漏洞利用、CMS 漏洞利用)
  • 会话劫持
  • 绕过 CSRF 保护
  • 键盘记录
  • 强制下载
  • 中间人攻击
  • 各种网络钓鱼:凭据收集、广告劫持(广告注入)、点击劫持、将用户重定向到恶意网站等。
  • 从本地会话网络存储中窃取数据,cookie,索引数据库,页面源代码,截屏
  • DoS 和 DDoS
  • 内容欺骗
  • 转移到隐藏的内部网络中,受防火墙保护:JS可用于主机和端口发现,服务识别和交互(速度极慢)
  • 窃取地理位置,捕获音频,网络摄像头或陀螺仪数据(需要明确许可)
  • 加密挖掘(很难,浏览器会尝试保护用户)

服务器端XSS甚至更糟,因为它允许:

  • 远程代码执行
  • 本地文件包含
  • 服务器端请求伪造
  • 内部路径披露
  • 从结果文档中窃取信息
  • DoS
  • 加密挖矿

攻击者还能够以实时模式获取信息并控制选项卡:

C2(命令和控制)服务器

关于XSS的误解

“如果网站使用仅限HTTP的cookie进行身份验证,XSS就不会构成威胁”

我经常听到这样的话,这太荒谬了。是的,攻击者无法使用 JavaScript 窃取仅限 HTTP 的 cookie;但是,他们甚至不需要。XSS的真正危险来自于在当前用户的上下文中执行任意JS的能力。如果攻击者无法窃取cookie并将其附加到从其计算机发出的恶意请求中,他们只会将恶意软件移动到受害者的浏览器中,浏览器将为他们附加cookie。我承认剥削变得更加复杂;但是,对于攻击者来说,它更隐蔽,更安全。

“XSS 是一种非持久性攻击类型#1:我离开易受攻击的页面,这很好”

又错了!一旦攻击者可以将任意JS注入您的浏览器,他们就可以更改应用程序的行为,以便您永远不会离开易受攻击的页面。通过操纵请求/响应和 HTML DOM,它们可以通过在易受攻击的页面上重新呈现新内容来使您看起来像离开了页面。但是,如果用户在地址栏中手动键入他们感兴趣的 URL,则可以击败这种欺骗。

“XSS 是一种非持久性攻击类型#2:我只是离开网站,没问题”

事实并非如此:恶意JavaScript文件可以保留在您的浏览器中。这种情况很少见,但仍然可以通过服务器工作者实现。要注册恶意服务辅助角色,必须满足以下条件之一:

  1. 攻击者必须在前端服务器上写入访问权限
  2. 公开了一个未筛选的 JSONP 终结点

如果攻击者设法注册了恶意服务辅助角色,他们可以无限期地在您的浏览器中保持持久性。Service Worker 可用于嗅探和修改流量(例如,为每个响应提供新的恶意脚本)。查看ShadowWorkers项目了解更多详情。

XSS 有多少种类型?

XSS 表现形式有几种不同的方式。安全专家通常会挑出 3.

基于 DOM 的 XSS。DOM XSS 代表 基于文档对象模型的跨站点脚本。如果 Web 应用程序在未进行适当清理的情况下将数据写入文档对象模型,则可能会发生基于 DOM 的 XSS 攻击。攻击者可以操纵此数据以在网页上包含恶意软件。要点:

  • 通常,基于 DOM 的跨站点脚本攻击是客户端攻击。恶意代码可能永远不会到达服务器。
  • 恶意软件在呈现 HTML 模板后执行;它发生在运行时的某个时间点。

反射的 XSS。当服务器获取请求的一部分并将其插入响应中而未进行适当的审查时,就会发生反射式 XSS。要点:

  • 反射的 XSS 有效负载始终到达服务器;它是请求和响应的一部分。
  • 与基于 DOM 的 XSS 不同,反射式 XSS 有效负载在浏览器呈现 HTML 模板时执行,因为有效负载是响应的一部分,通常嵌入到模板中。

存储的 XSS。当开发人员盲目信任存储在其数据库、Web 缓存、文件等中的数据时,就会发生存储的 XSS。要点:

  • 存储的XSS在某个地方(不一定是数据库)保存了一段时间
  • 有效负载可以在多个页面上执行,并且通常不需要任何用户交互即可触发(与基于 DOM 和反射的 XSS 不同,它们通常通过恶意链接传播并需要用户交互)。

如果我使用 React,那么我安全吗?

令人惊讶的是:React 对 XSS 并不完全安全,尽管它确实试图保护用户免受 XSS 的侵害。有几种方法可以将恶意 JS 注入到 React 应用程序中:

  • React 不会过滤你传递给 props 的内容:

    • href(通过“javascript:”或“data:text/html”URI进行利用)
    • src(通过“javascript:”或“data:text/html”URI进行利用)
    • srcDoc(通过插入恶意 HTML 进行利用)
    • formAction(通过“eval(…任意 js)”)
    • data(通过“javascript:”或“data:text/html”URI进行利用)
  • React 还允许您直接操作 DOM,绕过其限制和保护。你可以通过使用道具来实现这一点。作为“安全预防措施”,每当标签插入 .通过修改 XSS 有效负载可以轻松绕过此保护,例如:dangerouslySetInnerHTML<script>dangerouslySetInnerHTML

    • 使用 或<iframe src=”javascript:eval(...)”/>
    • <img id=’_malware_’ src=’x’ onerror=’eval(this.id)’ />
  • 这种突变允许您将标签注入 DOM<script>
  • 将恶意代码注入 React 应用程序的最后一个已知方法是滥用用户控制的 props 对象。如果攻击者控制了 props 对象的密钥,则他们可能能够通过滥用 、、、、 或使用 对 prop 进行毒害来嵌入漏洞利用。如果用户可以控制插入到 React 树中的 JSX 标签,则尤其危险。hrefsrcsrcDocdataformAction attributesdangerouslySetInnerHTML

如何防止 XSS?

第一步是在输出时对数据进行编码。

根据Portswigger Web Security Academy的说法,在将用户可控制的数据写入页面之前,应直接应用编码,因为您写入的上下文决定了需要使用哪种编码。例如,JavaScript 字符串中的值需要与 HTML 上下文中的值不同类型的转义。

在 HTML 上下文中,应将未列入白名单的值转换为 HTML 实体:

  • <转换为:&lt;
  • >转换为:&gt;

在 JavaScript 字符串上下文中,非字母数字值应该是 Unicode 转义的:

  • <转换为:u003c
  • >转换为:u003e

到达时验证输入

应尽可能严格地验证任何用户输入。例如:

  • 如果用户提交 URL,请手动将其强制转换为 URL 类,并验证它是否以安全协议 (HTTP / HTTPS) 开头
  • 如果用户提供的值应为数字,请将其显式转换为数字
  • 验证输入是否仅包含一组预期的字符

白名单和黑名单

输入验证通常应使用白名单而不是黑名单。例如,与其试图列出所有有害协议(javascript,数据等),不如简单地列出安全协议(HTTP,HTTPS)并禁止列表中未列出的任何内容。

允许“安全”的 HTML

最好的选择是使用在用户浏览器中执行过滤和编码的 JavaScript 库,例如 DOMPurify。其他库允许用户以降价格式提供内容并将降价转换为 HTML。不幸的是,所有这些库都会不时出现XSS漏洞,因此这不是一个完美的解决方案。如果您确实使用安全更新,则应密切监视安全更新。

如果你使用的是前端框架,你的另一个选择是将其解析为该框架的元素,就像在 React 中的 JSX 树中一样。有些库可以做到这一点;但是,手动解析它并不难,所以如果你确切地知道你应该渲染哪种 HTML,那么自己做可能会更安全。这样,您肯定会避免危险的道具,事件处理程序和有害的CSS。

使用内容安全策略 (CSP) 缓解 XSS

CSP 是防止跨站点脚本的最后一道防线。如果 XSS 防护失败,可以使用 CSP 通过限制攻击者可以执行的操作来缓解 XSS。 CSP 允许您控制各种内容,例如是否可以加载外部脚本以及是否将执行内联脚本。若要部署 CSP,需要包含一个名为 Content-Security-Policy 的 HTTP 响应标头,其中包含包含策略的值。

云解决方案提供商的示例如下:

default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'none'; base-uri 'none';

此策略指定只能从与主页相同的源加载图像和脚本等资源。因此,即使攻击者可以成功注入 XSS 有效负载,他们也只能从当前源加载资源。

如果需要加载外部资源,请确保仅允许不会帮助攻击者利用站点的脚本。例如,如果您将某些域列入白名单,则攻击者可以从这些域加载任何脚本。如果可能,请尝试在您自己的域中托管资源。

如果无法做到这一点,则可以使用基于哈希或随机数的策略来允许不同域上的脚本。nonce是作为脚本或资源的属性添加的随机字符串,仅当随机字符串与服务器生成的字符串匹配时才会执行。攻击者无法猜测随机字符串,因此无法调用具有有效随机数的脚本或资源,因此不会执行该资源。

服务器端保护

使用服务器端保护(如 Web 应用程序防火墙和入侵防御系统)可以帮助您拒绝发送到服务器的 XSS 有效负载。例如,AWS WAF 和 Snort IPS 具有一组规则来检测最常见的 XSS 有效负载,例如 .此外,IPS 系统附带已知的漏洞利用流量签名;例如,Snort能够检测并破坏CVE-2011-1897 – Microsoft Forefront Unified Access Gateway中的XSS漏洞。‘<script>alert(1)</script>’

注意将用户输入插入“脚本”标签

如果攻击者能够在评估JS的位置插入JS,那么您无能为力。有许多方法可以使用专用的混淆器或深奥的JS方言(如片假名,JJEncode或JSFuck)对恶意脚本进行编码和变异。考虑以下 JJEncode 片段:

发布者:小站,转转请注明出处:http://blog.gzcity.top/4896.html

(0)
打赏 微信扫一扫 微信扫一扫 支付宝扫一扫 支付宝扫一扫
上一篇 2023年6月2日 16:53
下一篇 2023年6月11日 22:23

相关推荐

  • Appium异常 Original error: Cannot find any free port in range 8200..8299

    Appium运行一段时间后就出现异常: log———> 2022-11-09 09:36:53 at io.appium.java_client.android.AndroidDriver.(AndroidDriver.java:94)log———> 2022-11-09 0…

    学习笔记 2022年11月9日
    7011110
  • Intellij IDEA激活码,IDEA稳定专属激活码

    2018.2~2023版本用这个,下面激活码直接复制粘贴到activation code即可激活软件,如果是新的版本,换新激活码的时候code with me也要激活一次 FDXL1Y2811-eyJsaWNlbnNlSWQiOiJGRFhMMVkyODExIiwibGljZW5zZWVOYW1lIjoiQmVub2l0IE1lbmVuZGV6IiwiYXN…

    2023年4月13日
    1.4K800
  • fastdfs的一些常见错误 getStoreStorage fail, errno code: 2

    错误1:getStoreStorage fail, errno code: 2 这个错误是storage没有启动 或者是配置错误 ,这是其中一个可能 我这里出现这个问题是因为没有启动 storage 启动会去连接 tracker server 所以你要是出现启动 storage的时候一直在等待(或者说卡死)的情况下 是因为他一直在连接tracker serv…

    2022年7月11日
    5.2K10790
  • API Security Weekly: Issue 162

    This week, we have details of compromised Google Cloud accounts being used to mine cryptocurrency (mainly with weak or no passwords on API connections), there’s an article on how G…

    安全 2022年5月3日
    775340
  • linux selenium 配置安装

    1.进入linux,首先安装谷歌浏览器,如果有的话,这步骤可以直接跳过。 方法: yum install https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm/usr/bin/google-chrome-stable -v //查看/usr/bin/google-…

    学习笔记 2022年10月11日
    45020

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注

评论列表(76条)

  • Matthewhoure
    Matthewhoure 2024年8月15日 20:06
  • Matthewhoure
    Matthewhoure 2024年8月16日 05:44
  • Matthewhoure
    Matthewhoure 2024年8月17日 02:53
  • uydu forum
    uydu forum 2024年8月19日 00:37

    Ive read several just right stuff here Certainly price bookmarking for revisiting I wonder how a lot effort you place to create this kind of great informative website

  • kalorifer sobası
    kalorifer sobası 2024年9月5日 18:39

    Your blog is a true hidden gem on the internet. Your thoughtful analysis and engaging writing style set you apart from the crowd. Keep up the excellent work!

  • kalorifer sobası
    kalorifer sobası 2024年9月29日 19:09

    Bu soba, içindeki yakıtın yanmasıyla oluşan ısıyı doğrudan çevresine yayar ve aynı zamanda suyun ısınmasını sağlar.

  • sex porn mom
    sex porn mom 2024年10月2日 00:15

    “Have you fucked, son? Have you fucked? Have you dumped that seed of yours in those balls into a moist hole?” His father asks as he leans forward on the commode-chair. His hand squeezing the bulge growing larger in his tan khakis. [url=https://arturzasada.pl/]filmy porno[/url] Daddy was furious as I could hear his deep breath. He sat down on the bench by the door. I was looking down afraid he was going to kick my ass. He lifted my head from my chin using the tip of his loafer where I can smell that smelly sheer socks he has been worn all day. Just when our eyes met, a big stinky manly wad landed on my face. Then I felt a big rough hand rubbing the spit all over my face. I heard the daddy say, “ next time remember what I told you exactly, I don’t want this to happen again, you hear me? I paused and said, “ yeeee…”. Before I finished the sentence, another spit and a big slap on me. “ when I told you something you must say yes. There is no room for you to argue or think, understood?” He said in a deep and firm tone. “ yes sir”. Without missing a beep I said it. “good boy, your night is just about to start.”

  • sex porn mom
    sex porn mom 2024年10月2日 00:58

    “What…huh…what, dad?” He asks, puzzled by the question from his dad. As his cock is mere inches from his dad’s face. sex porn mom His dad’s cock does not curve like that of his son, it angles like a fishing rod looking for fish under rushing river waters, from the deep furry patch between the father’s legs.

  • sex porn mom
    sex porn mom 2024年10月2日 01:59

    “Stoke your cock while you sniff that jock.” porn sex “I am fully grown now, Father.” He says in a heated rebuttal to his father’s words.

  • sex porn mom
    sex porn mom 2024年10月2日 07:35

    “I thought you usually showered after practice. In the locker room.” His dad asks as he walks into the open door of the bathroom. porn sex The pre-cum leaks, like a babbling brook, from the boy’s erect and pulsing cock, depositing its tiny droplets of juice onto the arm-hairs of his proud father. His father squeezes the nuts of his son, tighter and tighter, releasing more of the youthful essence.

  • sex porn mom
    sex porn mom 2024年10月2日 09:15

    “Coach told us. To go beat off. Seeing all those tents in our shorts; he said we should have all been working out naked. Our shorts weren’t covering up, anything, as our cock’s periscoped out and over the elastic waistbands of our shorts.” He says to his dad as he steps from the shower. sex porn mom “I am fully grown now, Father.” He says in a heated rebuttal to his father’s words.

  • sex porn mom
    sex porn mom 2024年10月2日 09:30

    His dad takes a seat upon the closed commode lid. [url=https://arturzasada.pl/]filmy porno[/url] His dad takes a seat upon the closed commode lid.

  • sex porn mom
    sex porn mom 2024年10月2日 12:32

    “I thought you usually showered after practice. In the locker room.” His dad asks as he walks into the open door of the bathroom. porno dla dzieci “Nope.” He says. Flatly. As he runs his hand over his still steely-hard length of his curved cock.

  • gay sex porn
    gay sex porn 2024年10月2日 18:56

    “Last I measured, I was nearly eight inches, dad. Maybe more. I may be even bigger, who knows.” He answers nonchalantly. “Let me get in there, Garrett.” His father says, as his son steps aside so he can get into the shower enclosure.

  • gay sex porn
    gay sex porn 2024年10月2日 19:59

    Garrett does not go hog-wild on his tool. He caresses and adores it like one would an idol. Garrett nods his head as he wraps the jock over his head, and takes a hearty breathe of the pouch placed over his nose.

  • gay sex porn
    gay sex porn 2024年10月3日 01:49

    “Yes! Yes! I know you understand.” His father proudly exclaims. “I figured you did.” His father says. “You play on a team, so you know the purpose of teamwork.”

  • gay sex porn
    gay sex porn 2024年10月3日 03:26

    “I think all of us were sprouting wood, today, dad.” He says. “Coach even noticed how hard we all were.” He does not hear the slamming of the front door. Neither does he hear the footsteps on the wood floor in the hallway. The shower drowns away all this noise.

  • gay sex porn
    gay sex porn 2024年10月3日 03:42

    “Do it!” His dad orders. “Yeah. Yessir. Dad.” Garrett mutters.

  • gay sex porn
    gay sex porn 2024年10月3日 06:58

    “Back in the day, back before we turned into a modern society, a man would grab another man’s balls and swear an oath on them in his hand and state his words to be true. To be a friend” His father says. “Do you know what I mean, son?” “Have you fucked, son? Have you fucked? Have you dumped that seed of yours in those balls into a moist hole?” His father asks as he leans forward on the commode-chair. His hand squeezing the bulge growing larger in his tan khakis.

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 08:56

    “Stoke your cock while you sniff that jock.” “Then, what is this, father.” He says as he wrestles his cock in a fierce grip and squeezes it like he is fighting against a serpent unleashed from its coil.

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 09:40

    After I serve daddy’s left one, I was about to move to the right foot. While He stopped me, stood up, and walked towards the couch, he said “Crawling right after me.” I followed daddy. My nose was where daddy’s ass was. I was staring at that crotch while I was crawling, and I didn’t realize daddy stopped one of a sudden in front of the bathroom. My nose is slightly right into that dreaming ass crack. “Have you fucked, son? Have you fucked? Have you dumped that seed of yours in those balls into a moist hole?” His father asks as he leans forward on the commode-chair. His hand squeezing the bulge growing larger in his tan khakis.

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 10:40

    “Yes! Yes! I know you understand.” His father proudly exclaims. “Yeah, dad, it’s me.” He shouts over the blistering rush of the shower spray as it pelts him hotly with force. “It was a rough practice.”

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 16:02

    “You know what you have to do. Doncha. Son.” His dad says. Garrett can see what his father is doing, unconsciously his hands moves to his cock. He strokes the length of his tool with his left hand while he teases the blistering red crown with the fingertips of his right hand. The lightning of his cool fingertips sends sparks through every nerve in his body.

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 17:38

    “That is your cock, son.” His father, says. “…but it does not make you a man. It only makes you a boy with a hard cock in his hand.” “Coach told us. To go beat off. Seeing all those tents in our shorts; he said we should have all been working out naked. Our shorts weren’t covering up, anything, as our cock’s periscoped out and over the elastic waistbands of our shorts.” He says to his dad as he steps from the shower.

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 17:52

    I used my teeth to strip off daddy’s black sheer socks. I placed them in my mouth and washed them with my saliva. I swallowed every single sweat and stink from these socks. It takes so well. I rolled them into a ball and stuck them into my jockstrap where my small dick and balls were. “This is what a man looks like, son.” His father says as his pants fall to the floor. From his waist out pops his representation of a 40-year-old-man. And father of two teenage boys. His cock.

  • porno dla dzieci
    porno dla dzieci 2024年10月5日 20:54

    “Yeah. Yessir. Dad.” Garrett mutters. “Yes! Yes! I know you understand.” His father proudly exclaims.

  • porn sex
    porn sex 2024年10月6日 17:55

    “Back in the day, back before we turned into a modern society, a man would grab another man’s balls and swear an oath on them in his hand and state his words to be true. To be a friend” His father says. “Do you know what I mean, son?” “Back in the day, back before we turned into a modern society, a man would grab another man’s balls and swear an oath on them in his hand and state his words to be true. To be a friend” His father says. “Do you know what I mean, son?”

  • porn sex
    porn sex 2024年10月6日 18:43

    “It was intense. Really intense. We ran so many drills. I am exhausted.” He explains. “Nope.” He says. Flatly. As he runs his hand over his still steely-hard length of his curved cock.

  • porn sex
    porn sex 2024年10月6日 19:52

    He runs the towel through his curl-filled hair, and down over his chest, where the early signs of his manhood sprout like an uneven crop of hairs across his chest that run down to his furry-pillowed crotch. Where the throbbing from his hard-on springs back as the damp towel whips his erection back and forth with each swipe of the now dampened towel. After I serve daddy’s left one, I was about to move to the right foot. While He stopped me, stood up, and walked towards the couch, he said “Crawling right after me.” I followed daddy. My nose was where daddy’s ass was. I was staring at that crotch while I was crawling, and I didn’t realize daddy stopped one of a sudden in front of the bathroom. My nose is slightly right into that dreaming ass crack.

  • gay sex porn
    gay sex porn 2024年10月7日 01:46

    “What did Coach have to say when he saw all those hard-young cocks in the locker room?” His dad asks. “Then, what is this, father.” He says as he wrestles his cock in a fierce grip and squeezes it like he is fighting against a serpent unleashed from its coil.

  • gay sex porn
    gay sex porn 2024年10月7日 03:31

    He runs the towel through his curl-filled hair, and down over his chest, where the early signs of his manhood sprout like an uneven crop of hairs across his chest that run down to his furry-pillowed crotch. Where the throbbing from his hard-on springs back as the damp towel whips his erection back and forth with each swipe of the now dampened towel. “Pick it up and smell the crotch.” His dad says.

  • gay sex porn
    gay sex porn 2024年10月7日 03:46

    He does not say anything in response to his father as his cock continues pulsing and jumping as the blood engorges his youthful cock more. And more. He does not hear the slamming of the front door. Neither does he hear the footsteps on the wood floor in the hallway. The shower drowns away all this noise.

  • gay sex porn
    gay sex porn 2024年10月7日 07:01

    “What are ya now, by the way?” “I think all of us were sprouting wood, today, dad.” He says. “Coach even noticed how hard we all were.”

  • free porn sex
    free porn sex 2024年10月10日 22:00

    “What…huh…what, dad?” He asks, puzzled by the question from his dad. As his cock is mere inches from his dad’s face.

  • free porn sex
    free porn sex 2024年10月10日 22:47

    Daddy smiled and said, “ that is my good boy. Don’t even want to leave your daddy’s Ripe socks on the floor. That’s the respect I love boy.” I then was told to clean his left foot. “Scrub these whitish paste out in my toenails. I want you to smell and place them in your mouth and let me see.” Daddy commented. It smelled and tasted like Brie cheese. Then I moved my tongue in between daddy’s toes. I cleaned up so well. Just thought I was finished. Daddy said,” the sole is clammy. It has nature feet oil after a whole day in the shoes, you think you finished fag. Keep working on that.”

  • free porn sex
    free porn sex 2024年10月10日 23:53

    That night, I did a whole spa routine to make sure my skin was soft and my ass was stretched and wet. I was wearing nothing but a jockstrap as I was told. Waiting by the door on fourth. My heartbeat was so fast as my mouth was dry. I heard the footstep approaching. I left the door unlocked as one of the instructions I was received from daddy. He stepped in with his size 10 Christian Loublitine loafer where my eyes were going up from there. When I made eye contact with daddy, daddy slapped me across the face and said, “Bad boy, Where the fuck are your sneakers as I told you to wear tonight.” I was trembling and said in a very low voice, “ sorry daddy I fooooorgot.”

  • free porn sex
    free porn sex 2024年10月11日 05:32

    “Yeah.” He answers his dad. “…and I was ‘going commando’ too.”

  • free porn sex
    free porn sex 2024年10月11日 07:17

    He lifts his head from its bowed stance and looks into the eyes of his father wanting some acknowledgement.

  • free porn sex
    free porn sex 2024年10月11日 07:32

    “You are grown. Yes. Physically. Yes, my son. But a full man. No! No!” His father, says, sharply. “You have much more to grow, to mature, before you are a man, before you can call yourself. A man.”

  • free porn sex
    free porn sex 2024年10月11日 10:45

    “Do it!” His dad orders.

  • free porn sex
    free porn sex 2024年10月13日 10:41

    Garrett does not go hog-wild on his tool. He caresses and adores it like one would an idol.

  • free porn sex
    free porn sex 2024年10月13日 11:43

    “My hard-on. Somewhat. But I have them all the time. You know that. You’ve made enough comments about me sportin’ boners in the morning when you see them at breakfast.”

  • free porn sex
    free porn sex 2024年10月13日 17:16

    “But you didn’t though, did you, son?”

  • free porn sex
    free porn sex 2024年10月13日 18:55

    “What are you now, son?”

  • free porn sex
    free porn sex 2024年10月13日 19:10

    After I serve daddy’s left one, I was about to move to the right foot. While He stopped me, stood up, and walked towards the couch, he said “Crawling right after me.” I followed daddy. My nose was where daddy’s ass was. I was staring at that crotch while I was crawling, and I didn’t realize daddy stopped one of a sudden in front of the bathroom. My nose is slightly right into that dreaming ass crack.

  • dzieciece porno
    dzieciece porno 2024年10月13日 22:29

    “That’s it! That’s it! That’s it!” His father bellows.

  • ThomasUsest
    ThomasUsest 2024年10月18日 23:03

    I think the admin of this site is actually working hard in support of his web page, for the reason that here every material is quality based data.

    puka.vn

  • ThomasUsest
    ThomasUsest 2024年10月18日 23:48

    Oh my goodness! Impressive article dude! Many thanks, However I am experiencing troubles with your RSS. I donit know the reason why I cannot subscribe to it. Is there anyone else having the same RSS issues? Anybody who knows the solution will you kindly respond? Thanks!!

    lamnaraicity.go.th

  • ThomasUsest
    ThomasUsest 2024年10月19日 00:49

    Your style is so unique compared to other folks I have read stuff from. I appreciate you for posting when you’ve got the opportunity, Guess I’ll just bookmark this blog.

    inspire-english.in.th

  • Lloydrot
    Lloydrot 2024年10月28日 20:24

    Fabulous, what a website it is! This blog presents valuable information to us, keep it up.

    https://www.fabriecio.nl/sweet-bonanza-slot-efsanevi-kazanclar-5/

  • Lloydrot
    Lloydrot 2024年10月28日 21:14

    Hi, every time i used to check website posts here in the early hours in the dawn, as i enjoy to learn more and more.

    https://gunstorebunker.com/bonanza-sweet-en-guvenilir-sweet-bonanza-slot-siteleri/

  • porno dla dzieci
    porno dla dzieci 2024年11月27日 23:25

    “Yeah. Yessir. Dad.” Garrett mutters.

  • porno dla dzieci
    porno dla dzieci 2024年11月28日 00:10

    “Was it because of that?” His dad asks as he points a finger towards him. And his midsection.

  • porno dla dzieci
    porno dla dzieci 2024年11月28日 01:10

    He reaches for and cups the wiggling low hangers of his teenage son.

  • vavada.net.pl
    vavada.net.pl 2024年11月28日 06:44

    That night, I did a whole spa routine to make sure my skin was soft and my ass was stretched and wet. I was wearing nothing but a jockstrap as I was told. Waiting by the door on fourth. My heartbeat was so fast as my mouth was dry. I heard the footstep approaching. I left the door unlocked as one of the instructions I was received from daddy. He stepped in with his size 10 Christian Loublitine loafer where my eyes were going up from there. When I made eye contact with daddy, daddy slapped me across the face and said, “Bad boy, Where the fuck are your sneakers as I told you to wear tonight.” I was trembling and said in a very low voice, “ sorry daddy I fooooorgot.”

  • vavada.net.pl
    vavada.net.pl 2024年11月28日 08:18

    I was surprised He wasn’t angry. He said,” boy you wait here, I am going to the bathroom.” He closed the door. He must sit on the toilet with pants down because I heard him losing the belt but didn’t hear him peeing. After a while, he called my name,” get in here ass sniffing slut.” I opened the door and crawled to the side of daddy. Daddy was still sitting on the toilet. . Just when I was confused why he sat that and did nothing. He stood up and pulled his pants up. I did take a peep of daddy’s huge uncut Middle Eastern dick. Half hard like 7inches already. While he was doing that, he grabbed my hair pushed right into the toilet, and closed the lid. “ smell my ass from there boy when it is still fresh.” He paused and continued, “ Don’t move.”

  • vavada.net.pl
    vavada.net.pl 2024年11月28日 08:32

    Garrett thinks to himself; he did not wear a jock home from practice. He was ‘going commando.” Is it his older brother’s jock? “Oh, well. “He mumbles to himself as he takes another whiff of the musky scented pouch of the jock.

  • Slottica PL
    Slottica PL 2024年11月28日 10:18

    “Once you plant that cock of yours in some squirmy hole and empty those warm balls of yours into a moist wet hole. Then you are on your way to becoming a man, and only then will you, come-of-age. But it is only a step onto the winding pathway towards manhood. It is my job to teach you what it means to be a man.” His father stands as he finishes his sentence. Loosening his belt and pulling his shirt out from the tucked confines of his pants.

  • Slottica PL
    Slottica PL 2024年11月28日 11:02

    He gulps once as his dad mounts more pressure on his balls. Squeezing them.

  • Slottica PL
    Slottica PL 2024年11月28日 12:05

    The helmet of the man’s cock weaves a picture of no recognition as the father’s cum streaks itself through the watery haze.

  • Slottica PL
    Slottica PL 2024年11月28日 17:49

    “What…huh…what, dad?” He asks, puzzled by the question from his dad. As his cock is mere inches from his dad’s face.

  • Slottica PL
    Slottica PL 2024年11月28日 19:26

    He reaches and lets his hand glide over his swelled cock. Tickling the head of his bulbous cock with his rough fingertips which sends electric sparks through him and down to his toes.

  • truck scale maintenance Iraq
    truck scale maintenance Iraq 2024年11月30日 10:33

    Dedicated to excellence, BWER offers Iraq’s industries durable, reliable weighbridge systems that streamline operations and ensure compliance with local and global standards.

  • digital truck scales Iraq
    digital truck scales Iraq 2024年11月30日 10:57

    With a focus on precision and reliability, BWER offers state-of-the-art weighbridge systems to Iraq’s industries, meeting international standards and supporting operational efficiency.

  • weighbridge truck scales in Baghdad
    weighbridge truck scales in Baghdad 2024年11月30日 12:08

    BWER Company provides Iraq’s leading-edge weighbridge solutions, designed to withstand harsh environments while delivering top-tier performance and accuracy.

  • heavy-duty truck scales Iraq
    heavy-duty truck scales Iraq 2024年11月30日 12:43

    Serving Iraq with pride, BWER supplies high-performance weighbridges designed to improve transport logistics, reduce inaccuracies, and optimize industrial processes across all sectors.

  • truck scale software in Iraq
    truck scale software in Iraq 2024年11月30日 12:44

    BWER leads the way in weighbridge technology in Iraq, delivering customized weighing solutions that are accurate, efficient, and ideal for heavy-duty use in any environment.

  • binance us
    binance us 2024年12月7日 02:54

    Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.

  • JeremyBor
    JeremyBor 2024年12月11日 17:12

    Этот медицинский обзор сосредоточен на последних достижениях, которые оказывают влияние на пациентов и медицинскую практику. Мы разбираем инновационные методы лечения и исследований, акцентируя внимание на их значимости для общественного здоровья. Читатели узнают о свежих данных и их возможном применении.
    Получить больше информации – https://vyvod-iz-zapoya-17.ru/

  • Michaelambub
    Michaelambub 2025年1月2日 05:59

    I got what you mean , thankyou for posting.Woh I am delighted to find this website through google. “Success is dependent on effort.” by Sophocles.

    https://dreamhouseconstructions.co.in/2024/12/16/get-in-on-the-action-with-dafabet-betting-official-website/

  • Michaelambub
    Michaelambub 2025年1月2日 06:50

    You actually make it seem so easy with your presentation but I find this topic to be actually something that I believe I would never understand. It kind of feels too complex and very broad for me. I’m taking a look ahead on your next publish, I will attempt to get the hang of it!

    https://nrcfreshcuts.in/2024/11/30/unleash-the-excitement-at-dafabet-betting-official-website/

  • قوائم الأعمال الإلكترونية

    For businesses looking to expand their reach in Iraq, Businessiraq.com offers a range of marketing and advertising solutions. The website’s advertising platform allows businesses to reach a targeted audience of professionals and decision-makers, increasing their brand awareness and online visibility. With its advanced targeting options, businesses can tailor their advertising campaigns to specific industries, locations, and job functions, ensuring that their message reaches the right people. By providing a range of advertising options, Businessiraq.com helps businesses to connect with their target audience and achieve their marketing goals.

  • Market Research Iraq
    Market Research Iraq 2025年1月19日 01:17

    Keeping its users informed, Businessiraq.com also provides up-to-date Iraq business news. Staying abreast of market trends, regulatory changes, and economic developments is crucial for any business looking to thrive in Iraq. The news section on Businessiraq.com is meticulously curated to deliver relevant and timely information, ensuring that users can make informed decisions. By offering insights into the ever-evolving business landscape, the platform empowers users to navigate challenges and seize opportunities with confidence.

  • Iraq Agriculture Tenders
    Iraq Agriculture Tenders 2025年1月19日 01:25

    Looking for a quick and efficient entry point into the Iraqi market? Businessiraq.com is your solution. This vital Iraq business directory provides an extensive collection of online business listings, offering unparalleled access to Iraqi companies. Benefit from up-to-date business news in Iraq, discover a wide range of Iraq jobs, and seize tender opportunities to grow your business in this promising market. Businessiraq.com provides a seamless experience for businesses seeking to expand their global reach.

  • Baghdad business listings
    Baghdad business listings 2025年1月19日 02:01

    Unlock the potential of the Iraqi market with Businessiraq.com. This essential Iraq business directory presents a wealth of online business listings, fostering connections between companies and facilitating market entry. Access up-to-date business news in Iraq, browse promising Iraq jobs, and find tender opportunities for procurement. Businessiraq.com is the key to unlocking the Iraqi business world.

  • Iraq Index
    Iraq Index 2025年1月19日 02:46

    Comprehensive Iraq Business Directory Businessiraq.com is the leading online platform for connecting businesses within Iraq through its extensive Iraq Business Directory. This resource features detailed listings of various companies, from startups to established enterprises, making it easier for users to find potential partners, suppliers, and clients across numerous sectors. By prioritizing user-friendly navigation and precise categories, Businessiraq.com enhances search engine optimization (SEO), ensuring that those searching for reputable Iraqi businesses can easily access vital information. Whether you are a local entrepreneur or an international investor, the Iraq Business Directory on Businessiraq.com serves as an indispensable tool for fostering business growth and collaboration.