NetKuang is an extension to Baldwin's SU-Kuang. It runs on networks of computers using Unix and can nd vulnerabilities created by poor system con guration. Vulnerabilities are discovered using a backwards goal-based search that is breadthrst on individual hosts and parallel when multiple hosts are checked. An implementation in C++ found real vulnerabilities on production systems. Tests show reasonably fast performance on an LAN.