Originally Posted by topolb

Well, you are right. You can insert custom packets if you have the keystream derived from a known plaintext attack without knowking the key.

I saw somewhere a tool that implements this