Skip to content
HackIndex.io

OSWP · Module 17

Connecting to Networks Manually

Connect to WPA/WPA2 Personal and Enterprise networks manually with wpa_supplicant, then enumerate the network to reach the proof.

~1 h 2 resources Last updated September 27, 2026

Recovering a key is not the end of the OSWP objective: you must connect to the target access point and read proof.txt from it. PEN-210 covers connecting to WPA/WPA2 Personal and Enterprise networks manually from the command line, without relying on a desktop network manager, and then orienting yourself on the network to reach the proof. Doing this by hand also avoids the insecure auto-connect behavior that is itself an attack surface.

Connecting Manually

nmcli offers a quick connect, but wpa_supplicant gives full control and works headless: you write a configuration for a PSK or enterprise (EAP) network, bring up the interface, and request an IP with dhclient. Knowing the wpa_supplicant workflow, when to prefer it over nmcli, common connection failures, and how to disconnect and clean up is essential when the exam network does not behave like a normal one.

Reconnaissance After Access

Once connected, confirm your network position, find the gateway, and enumerate what is reachable: host discovery, common service scans, other subnets, and DNS/DHCP and management interfaces. On the OSWP this leads you to http://192.168.1.1/proof.txt; in a real engagement it is the pivot point into the wired network behind the AP.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.