I read about 802.11 networks and found out that all the frames from client are directed to the AP. How can I forge IEEE 802.11 packets so that I can send them directly to the clients using the group encryption key and hence spoofing as the AP. In other words, how can I exploit the hole 196?
If you want to inject custom frames on a Linux machine its pretty straightforward. The Linux wireless stack lets you create a virtual monitor mode device alongside the normal device.
iw phy phy0 interface add mon0 type monitor ifconfig mon0 promisc up
Anything written to this device will be sent directly over the air without any further processing. This lets you format a layer 2 frame with whatever fields you require. Of course, a lot depends on the actual hardware itself - some cards do not allow injection of raw frames. Others do not provide for fine control. To control the transmission (what rate its sent at etc.) you will have to prepend a radiotap header and the details of which fields will be needed will depend on the WNIC hardware you are using.