Advanced
🔥 Advanced

Covert Entry Techniques

Advanced physical bypass methods for secured doors, motion sensors, and access control systems. These techniques require proper authorization and specialized tools.

Advanced Authorization Required

Covert entry techniques can cause damage and trigger alarms. Ensure your scope of work explicitly authorizes these methods. Have the client's 24/7 emergency contact ready, and coordinate with security teams for silent alarm handling.

Door Bypass Methods

🚪 Shove Knife / Loiding

A thin, flexible tool inserted between door and frame to push back spring latches.

  • • Works on: Outward-opening doors with spring latches
  • • Defeated by: Deadbolts, anti-shim plates, proper latch guards
  • • Time: 2-10 seconds with practice

🔓 Under-Door Tool

Thin rod with lever hook slides under door gap to manipulate inside handle.

  • • Works on: Lever handles, panic bars from inside
  • • Defeated by: Door sweeps, small gaps, knob handles
  • • Time: 5-30 seconds

📎 Traveler Hook

Wire tool inserted through door gap to pull thumbturn or bypass crash bars.

  • • Works on: Doors with gaps, glass panels nearby
  • • Defeated by: Small gaps, thumbturn guards
  • • Time: 10-60 seconds

🎈 Air Wedge

Inflatable bladder creates gap for insertion of bypass tools.

  • • Works on: Most door frames with some flex
  • • Defeated by: Reinforced frames, tight tolerances
  • • Time: 15-45 seconds to create gap

Request-to-Exit (REX) Bypass

Many access-controlled doors use motion sensors (PIR) on the inside to unlock for egress. These can often be triggered from outside.

OUTSIDE
Gap
← Trigger point
Door
PIR Motion Sensor
(REX sensor)
INSIDE
Attack Methods:
  1. Spray through gap (compressed air, CO2)
  2. Insert wire/rod to create motion
  3. Slide paper under door and pull back
  4. Use thermal differential (lighter, ice spray)
rex-bypass.sh
bash
# Method 1: Compressed Air
# Insert straw through door gap, spray compressed air
# PIR detects rapid temperature change → door unlocks

# Method 2: Wire Motion
# Insert flexible wire through gap above door
# Wave it in front of PIR sensor
# Best with doors that have air gaps at top

# Method 3: Paper Slide
# Slide newspaper/paper under door
# Quickly pull it back out
# Motion triggers REX sensor

# Method 4: Thermal Attack
# Some PIR sensors detect infrared (heat)
# Compressed air upside-down = freezing spray
# Lighter/heat source through gap
# Temperature differential triggers sensor

# Method 5: Under-Door Camera + REX Button
# Use borescope camera under door
# Locate REX button/push plate
# Trigger with under-door tool

Magnetic Lock (Maglock) Attacks

Power Failure

Maglocks require constant power. Interrupt power = door opens.

  • • Trip breaker (if accessible)
  • • Cut power wire (destructive)
  • • Wait for power outage (fire alarm)
  • • May have battery backup - check for UPS

REX Sensor Abuse

Most maglocks release when PIR detects egress motion.

  • • Trigger REX from outside (see above)
  • • Door gap attacks work well
  • • Compressed air is most reliable

Fire Code

Maglocks must release during fire alarms (life safety). Triggering a fire alarm will open these doors, but this is typically outside the scope of authorized testing.

Electric Strike Vulnerabilities

Electric strikes are common on access-controlled doors. They modify the door frame to allow the latch to release when power is applied.

Type Behavior Attack Vector
Fail-Secure Locked when power lost Apply power to unlock wire (if accessible)
Fail-Safe Unlocked when power lost Cut power, trip breaker
bash
# Check strike type from outside
# Look at wire count: 
# - 2 wires usually = 12V/24V DC
# - May have additional REX wires

# Fail-Safe Detection
# If door releases during fire alarm test = fail-safe
# Check local fire codes for requirements

# Frame Attack
# If strike is poorly installed:
# - Shove knife may still work
# - Latch may not fully engage strike pocket

# Power Analysis
# If wiring is accessible in adjacent ceiling:
# - Trace wires to door
# - Apply/remove power as needed
# - Document for report

Crash Bar Attacks

Panic bars (crash bars) are designed for quick egress. This life-safety requirement creates vulnerabilities.

Gap Attack

Insert tool through door gap to push crash bar lever

Under-Door

Hook tool under door to pull crash bar down

Mail Slot

If present, reach through to activate bar

Motion Sensor Evasion

Alarm systems often use PIR (Passive Infrared) motion detectors. Understanding their limitations enables evasion.

PIR Detection Patterns (Top View)

PIR
Detection Zone
Blind spot: Directly under sensor
Blind spot: Behind obstacles
Weak detection at edges
plaintext
# PIR (Passive Infrared) Sensors
# Detect: Body heat differential vs background
# Range: 15-50 feet typically
# Angle: 90-180 degrees horizontal

# Weaknesses:
1. Slow movement (thermal equilibrium)
2. Thermal masking (emergency blanket)
3. Direct approach (narrow detection at distance)
4. Height - sensors aimed at chest level
5. Obstacles block IR

# Microwave Sensors (Dual-Tech)
# Detect: Movement via doppler effect
# Harder to defeat - detects all motion
# Often combined with PIR (both must trigger)

# Evasion Strategies:
1. Map sensor locations during recon
2. Move slowly (< 1 ft/second)
3. Stay low or high (avoid sensor plane)
4. Use obstacles for cover
5. Approach directly from distance (narrow FOV)
6. Thermal blanket over body (last resort)

# Note: Modern sensors are very sensitive
# Evasion is difficult and unreliable
# Better to bypass via entry point selection

Reality Check

Motion sensor evasion is unreliable against modern commercial systems. It's typically easier to avoid areas with motion sensors or find alternative entry points than to attempt evasion.

Covert Entry Toolkit

Door Bypass

  • • Shove knife set (various sizes)
  • • Under-door tool kit
  • • Traveler hooks and wire
  • • Air wedge set
  • • Flexible borescope camera
  • • Compressed air cans

Supporting Gear

  • • Penlight / red-light flashlight
  • • Mirror on extendable rod
  • • Lock pick set
  • • RFID cloning equipment
  • • Multi-tool with knife, pliers
  • • Gloves (avoid fingerprints)

⚠️ Legal & Ethical Boundaries

Covert entry techniques can cause property damage and may trigger alarm responses. Always have explicit written authorization specifying these methods are in scope. Document every technique attempted, whether successful or not. If discovered, immediately identify yourself and present authorization.