# Connecting to Networks Manually

> Connect to WPA/WPA2 Personal and Enterprise networks manually with wpa_supplicant, then enumerate the network to reach the proof.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/manual-network-connections
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 1
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

Recovering a key is not the end of the OSWP objective: you must connect to the target access point and read proof.txt from it. PEN-210 covers connecting to WPA/WPA2 Personal and Enterprise networks manually from the command line, without relying on a desktop network manager, and then orienting yourself on the network to reach the proof. Doing this by hand also avoids the insecure auto-connect behavior that is itself an attack surface.

## Connecting Manually

nmcli offers a quick connect, but wpa_supplicant gives full control and works headless: you write a configuration for a PSK or enterprise (EAP) network, bring up the interface, and request an IP with dhclient. Knowing the wpa_supplicant workflow, when to prefer it over nmcli, common connection failures, and how to disconnect and clean up is essential when the exam network does not behave like a normal one.

## Reconnaissance After Access

Once connected, confirm your network position, find the gateway, and enumerate what is reachable: host discovery, common service scans, other subnets, and DNS/DHCP and management interfaces. On the OSWP this leads you to http://192.168.1.1/proof.txt; in a real engagement it is the pivot point into the wired network behind the AP.

## Study material

- [Manual Network Connection with wpa_supplicant](https://hackindex.io/platforms/wireless/post-exploitation/manual-network-connection-wpa-supplicant.md) (read, core)
- [Network Reconnaissance After Wireless Access](https://hackindex.io/platforms/wireless/post-exploitation/network-reconnaissance-after-wireless-access.md) (read, core)