Covert Entry Techniques
Advanced physical bypass methods for secured doors, motion sensors, and access control systems. These techniques require proper authorization and specialized tools.
Advanced Authorization Required
Door Bypass Methods
🚪 Shove Knife / Loiding
A thin, flexible tool inserted between door and frame to push back spring latches.
- • Works on: Outward-opening doors with spring latches
- • Defeated by: Deadbolts, anti-shim plates, proper latch guards
- • Time: 2-10 seconds with practice
🔓 Under-Door Tool
Thin rod with lever hook slides under door gap to manipulate inside handle.
- • Works on: Lever handles, panic bars from inside
- • Defeated by: Door sweeps, small gaps, knob handles
- • Time: 5-30 seconds
📎 Traveler Hook
Wire tool inserted through door gap to pull thumbturn or bypass crash bars.
- • Works on: Doors with gaps, glass panels nearby
- • Defeated by: Small gaps, thumbturn guards
- • Time: 10-60 seconds
🎈 Air Wedge
Inflatable bladder creates gap for insertion of bypass tools.
- • Works on: Most door frames with some flex
- • Defeated by: Reinforced frames, tight tolerances
- • Time: 15-45 seconds to create gap
Request-to-Exit (REX) Bypass
Many access-controlled doors use motion sensors (PIR) on the inside to unlock for egress. These can often be triggered from outside.
- Spray through gap (compressed air, CO2)
- Insert wire/rod to create motion
- Slide paper under door and pull back
- Use thermal differential (lighter, ice spray)
# Method 1: Compressed Air
# Insert straw through door gap, spray compressed air
# PIR detects rapid temperature change → door unlocks
# Method 2: Wire Motion
# Insert flexible wire through gap above door
# Wave it in front of PIR sensor
# Best with doors that have air gaps at top
# Method 3: Paper Slide
# Slide newspaper/paper under door
# Quickly pull it back out
# Motion triggers REX sensor
# Method 4: Thermal Attack
# Some PIR sensors detect infrared (heat)
# Compressed air upside-down = freezing spray
# Lighter/heat source through gap
# Temperature differential triggers sensor
# Method 5: Under-Door Camera + REX Button
# Use borescope camera under door
# Locate REX button/push plate
# Trigger with under-door toolMagnetic Lock (Maglock) Attacks
Power Failure
Maglocks require constant power. Interrupt power = door opens.
- • Trip breaker (if accessible)
- • Cut power wire (destructive)
- • Wait for power outage (fire alarm)
- • May have battery backup - check for UPS
REX Sensor Abuse
Most maglocks release when PIR detects egress motion.
- • Trigger REX from outside (see above)
- • Door gap attacks work well
- • Compressed air is most reliable
Fire Code
Electric Strike Vulnerabilities
Electric strikes are common on access-controlled doors. They modify the door frame to allow the latch to release when power is applied.
| Type | Behavior | Attack Vector |
|---|---|---|
| Fail-Secure | Locked when power lost | Apply power to unlock wire (if accessible) |
| Fail-Safe | Unlocked when power lost | Cut power, trip breaker |
# Check strike type from outside
# Look at wire count:
# - 2 wires usually = 12V/24V DC
# - May have additional REX wires
# Fail-Safe Detection
# If door releases during fire alarm test = fail-safe
# Check local fire codes for requirements
# Frame Attack
# If strike is poorly installed:
# - Shove knife may still work
# - Latch may not fully engage strike pocket
# Power Analysis
# If wiring is accessible in adjacent ceiling:
# - Trace wires to door
# - Apply/remove power as needed
# - Document for reportCrash Bar Attacks
Panic bars (crash bars) are designed for quick egress. This life-safety requirement creates vulnerabilities.
Gap Attack
Insert tool through door gap to push crash bar lever
Under-Door
Hook tool under door to pull crash bar down
Mail Slot
If present, reach through to activate bar
Motion Sensor Evasion
Alarm systems often use PIR (Passive Infrared) motion detectors. Understanding their limitations enables evasion.
PIR Detection Patterns (Top View)
# PIR (Passive Infrared) Sensors
# Detect: Body heat differential vs background
# Range: 15-50 feet typically
# Angle: 90-180 degrees horizontal
# Weaknesses:
1. Slow movement (thermal equilibrium)
2. Thermal masking (emergency blanket)
3. Direct approach (narrow detection at distance)
4. Height - sensors aimed at chest level
5. Obstacles block IR
# Microwave Sensors (Dual-Tech)
# Detect: Movement via doppler effect
# Harder to defeat - detects all motion
# Often combined with PIR (both must trigger)
# Evasion Strategies:
1. Map sensor locations during recon
2. Move slowly (< 1 ft/second)
3. Stay low or high (avoid sensor plane)
4. Use obstacles for cover
5. Approach directly from distance (narrow FOV)
6. Thermal blanket over body (last resort)
# Note: Modern sensors are very sensitive
# Evasion is difficult and unreliable
# Better to bypass via entry point selectionReality Check
Covert Entry Toolkit
Door Bypass
- • Shove knife set (various sizes)
- • Under-door tool kit
- • Traveler hooks and wire
- • Air wedge set
- • Flexible borescope camera
- • Compressed air cans
Supporting Gear
- • Penlight / red-light flashlight
- • Mirror on extendable rod
- • Lock pick set
- • RFID cloning equipment
- • Multi-tool with knife, pliers
- • Gloves (avoid fingerprints)
⚠️ Legal & Ethical Boundaries
Covert entry techniques can cause property damage and may trigger alarm responses. Always have explicit written authorization specifying these methods are in scope. Document every technique attempted, whether successful or not. If discovered, immediately identify yourself and present authorization.