Skip to content
HackIndex logo

HackIndex

Manual Network Connection with wpa_supplicant

2 min read Mar 17, 2026

After recovering a WPA/WPA2 passphrase or enterprise credentials, connecting to the network directly gives you a routable IP address and full access to the internal segment. nmcli is the simplest method when NetworkManager is running, but wpa_supplicant and dhclient give direct control without depending on NetworkManager — useful when NetworkManager has been killed for monitor mode or when connecting to enterprise networks that require specific EAP configuration.

Connect to a WPA/WPA2 Personal Network with nmcli

The fastest method when NetworkManager is running:

┌──(kali㉿kali)-[~]
└─$ nmcli dev wifi connect "TargetNetwork" password "recoveredpassword" 
Device 'wlan0' successfully activated with 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.

If NetworkManager was killed for monitor mode, restart it first:

┌──(kali㉿kali)-[~]
└─$ systemctl start NetworkManager
┌──(kali㉿kali)-[~]
└─$ nmcli dev wifi connect "TargetNetwork" password "recoveredpassword"

Connect with wpa_supplicant Manually

When you need direct control without NetworkManager, generate a wpa_supplicant configuration from the SSID and passphrase:

┌──(kali㉿kali)-[~]
└─$ wpa_passphrase TargetNetwork recoveredpassword > /tmp/wpa.conf

Start wpa_supplicant against the interface in managed mode:

┌──(kali㉿kali)-[~]
└─$ wpa_supplicant -D nl80211 -i wlan0 -c /tmp/wpa.conf -B 
Successfully initialized wpa_supplicant

-D nl80211 specifies the driver. -B runs wpa_supplicant in the background. After a few seconds, check the connection status:

┌──(kali㉿kali)-[~]
└─$ wpa_cli status 
wpa_state=COMPLETED
ssid=TargetNetwork
bssid=aa:bb:cc:dd:ee:ff
ip_address=192.168.1.105

wpa_state=COMPLETED confirms the 4-way handshake completed and the session is active. If an IP is not shown, request one with dhclient.

Request an IP Address with dhclient

After wpa_supplicant connects, request a DHCP lease:

┌──(kali㉿kali)-[~]
└─$ dhclient wlan0

Verify the assigned address and gateway:

┌──(kali㉿kali)-[~]
└─$ ip addr show wlan0
┌──(kali㉿kali)-[~]
└─$ ip route show

Connect to a WPA Enterprise Network with wpa_supplicant

Enterprise connections require a more detailed wpa_supplicant configuration. Create the config manually for PEAP/MSCHAPv2:

┌──(kali㉿kali)-[~]
└─$ cat > /tmp/enterprise.conf << 'EOF'
network={
ssid="CorpWifi"
key_mgmt=WPA-EAP
eap=PEAP
identity="CORP\\jsmith"
password="recoveredpassword"
phase2="auth=MSCHAPV2"
ca_cert="/etc/ssl/certs/ca-certificates.crt"
}
EOF
┌──(kali㉿kali)-[~]
└─$ wpa_supplicant -D nl80211 -i wlan0 -c /tmp/enterprise.conf -B
┌──(kali㉿kali)-[~]
└─$ dhclient wlan0

If the enterprise network uses a self-signed or internal CA certificate, set ca_cert to the path of the CA file or remove the line entirely and add phase1="peaplabel=0" and ca_cert="" to skip certificate validation — only appropriate when the network is already known to not validate certificates.

Disconnect and Clean Up

┌──(kali㉿kali)-[~]
└─$ dhclient -r wlan0
┌──(kali㉿kali)-[~]
└─$ killall wpa_supplicant

References