[caf]

Or spoof DNS responses to point to a machine under your control.

[sp332]

Or spoof a disassociation frame, then impersonate the access point so the victim connects to your computer instead.