# Manual Network Connection with wpa_supplicant

> Manually configure and authenticate wireless connections using wpa_supplicant for post-exploitation network access without GUI tools.

- **URL:** https://hackindex.io/platforms/wireless/post-exploitation/manual-network-connection-wpa-supplicant
- **Path:** Wireless > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/wireless/post-exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

After recovering a WPA/WPA2 passphrase or enterprise credentials, connecting to the network directly gives you a routable IP address and full access to the internal segment. For a wpa_supplicant manual connection on Kali, you get direct control without depending on NetworkManager: useful when NetworkManager has been killed for monitor mode or when connecting to enterprise networks that require specific EAP configuration. nmcli is the simplest method when NetworkManager is running, but wpa_supplicant and dhclient work in situations where NetworkManager is unavailable or interferes.

## Connect to a WPA/WPA2 Personal Network with nmcli

The fastest method when NetworkManager is running:

```bash
nmcli dev wifi connect "TargetNetwork" password "recoveredpassword"
# Device 'wlan0' successfully activated with 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.
```

If NetworkManager was killed for monitor mode, restart it first:

```bash
systemctl start NetworkManager
nmcli dev wifi connect "TargetNetwork" password "recoveredpassword"
```

## wpa_supplicant Manual Connection on Kali

When you need direct control without NetworkManager, generate a wpa_supplicant configuration from the SSID and passphrase:

```bash
wpa_passphrase TargetNetwork recoveredpassword > /tmp/wpa.conf
```

Start wpa_supplicant against the interface in managed mode:

```bash
wpa_supplicant -D nl80211 -i wlan0 -c /tmp/wpa.conf -B
# Successfully initialized wpa_supplicant
```

`-D nl80211` specifies the driver. `-B` runs wpa_supplicant in the background. After a few seconds, check the connection status:

```bash
wpa_cli status
# wpa_state=COMPLETED
# ssid=TargetNetwork
# bssid=aa:bb:cc:dd:ee:ff
# ip_address=192.168.1.105
```

`wpa_state=COMPLETED` confirms the 4-way handshake completed and the session is active. If an IP is not shown, request one with dhclient.

## Request an IP Address with dhclient

After wpa_supplicant connects, request a DHCP lease:

```bash
dhclient wlan0
```

Verify the assigned address and gateway:

```bash
ip addr show wlan0
ip route show
```

## Connect to a WPA Enterprise Network with wpa_supplicant

Enterprise connections require a more detailed wpa_supplicant configuration. Create the config manually for PEAP/MSCHAPv2:

```bash
cat > /tmp/enterprise.conf << 'EOF'
network={
    ssid="CorpWifi"
    key_mgmt=WPA-EAP
    eap=PEAP
    identity="CORP\\jsmith"
    password="recoveredpassword"
    phase2="auth=MSCHAPV2"
    ca_cert="/etc/ssl/certs/ca-certificates.crt"
}
EOF
```

```bash
wpa_supplicant -D nl80211 -i wlan0 -c /tmp/enterprise.conf -B
```

```bash
dhclient wlan0
```

If the enterprise network uses a self-signed or internal CA certificate, set `ca_cert` to the path of the CA file or remove the line entirely and add `phase1="peaplabel=0"` and `ca_cert=""` to skip certificate validation: only appropriate when the network is already known to not validate certificates.

## Troubleshooting wpa_supplicant Connection Issues

Common problems when connecting with wpa_supplicant on Kali:

- **"nl80211: Could not configure driver mode"**: the interface is still in monitor mode. Bring it down and set it to managed mode: `ip link set wlan0 down && iw wlan0 set type managed && ip link set wlan0 up`.
- **"CTRL-EVENT-ASSOC-REJECT"**: the AP rejected the association. Verify the SSID and passphrase are correct. For enterprise networks, double-check the identity format (DOMAIN\user vs user@domain).
- **wpa_supplicant hangs with no output**: NetworkManager may be fighting for control of the interface. Kill it with `systemctl stop NetworkManager` or use `wpa_supplicant` with `-D wext` as an alternative driver.
- **No IP address after successful association**: dhclient may have timed out or the DHCP server did not respond. Run `dhclient -v wlan0` for verbose output. If DHCP fails repeatedly, assign a static IP in the same subnet observed during reconnaissance.
- **Connection drops after a few seconds**: another process is reconfiguring the interface. Check for `wpa_supplicant` instances already running with `ps aux | grep wpa_supplicant` and kill duplicates.

## When to Use nmcli vs wpa_supplicant

Choose based on your situation:

- Use **nmcli** when NetworkManager is running and you need a quick WPA-Personal connection. It handles DHCP, DNS, and routing automatically.
- Use **wpa_supplicant** when NetworkManager is stopped (common after running airmon-ng), when you need enterprise EAP configuration, or when you need to connect to a hidden SSID with specific parameters.
- Use **wpa_supplicant** when you want to avoid NetworkManager logging connection details to system journals, which matters for OPSEC on a shared system.

## Disconnect and Clean Up

```bash
dhclient -r wlan0
killall wpa_supplicant
```

## References

- [Arch Linux Wiki: wpa_supplicant](https://wiki.archlinux.org/title/wpa_supplicant) - Full wpa_supplicant configuration reference including enterprise EAP settings
- [dhclient man page](https://linux.die.net/man/8/dhclient) - DHCP lease request and release flags