I understand that sniffing the WEP/WPA handshake can give you enough info for a brute force attack using rainbow tables but you are not spoofing at this point, you are cracking the encryption key which is key to the whole encrypted tunnel. No key - no entry and no data. Once you have that you set yourself up as a man in the middle decrypting the stream from the client, changing what you want (or just reading the data) then re encrypting the stream to the server. At this point you are spoofing as the server and host but you need to be able to read the data to do anything remotely interesting
MS arent going to use some basic encryption cipher (you would hope) to allow a simple brute force attack (one that doesnt involve a large computing cluster at least).
