Try some of the logins/pass combos you extracted from cloaknet. That will get you into an account, and from there you should be able to spot some useful vulnerabilities.

I think I see the problem. You're trying to hack wraithmail, which is extremely difficult if not impossible. As you observed, the xss is isolated on the wraithbox domain, so it can't be used to...

Spoilers

You need to extract data from a couple of accounts on gghb; the one of the person you're tracking, and the admin's. Naturally, hacking the admin's account is more difficult. You can...

Where are you stuck?

(I intentionally haven't released a public walkthrough since I don't want to provide an easy way out, but I'm happy to help people who are truly stymied)