title: What is the non-standard HTTP verb "DEBUG" used for in ASP.NET/IIS?
body: <p>I am reading a report from a "web application security" company, whom have been scanning a few websites of the company I am working for. It appears from the report - which seems written without any human involvement - that several attempts where made to break our sites using requests like this:</p>
  
  <pre><code>DEBUG /some_path/some_unexisting_file.aspx
  Accept: */*
  More-Headers: ...
  </code></pre>
  
  <p>The result from our server surprises me:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Headers: ...
  </code></pre>
  
  <p>As <code>DEBUG</code> does not seem to be mentioned anywhere in the <a href="http://www.w3.org/Protocols/rfc2616/rfc2616.html" rel="noreferrer">HTTP 1.1 specification</a> I would have expected the result to be <code>400 Bad Request</code> or <code>405 Method Not Allowed</code>.</p>
  
  <p>From <a href="https://stackoverflow.com/questions/418741/asp-net-iis-remote-debugging-debug-verb">earlier question on SO</a>, I have learned that the <code>DEBUG</code> verb is used in some sort of remote debugging of ASP.NET applications, but not many details are available in that question or its answers.</p>
  
  <p>Exactly what is the <code>DEBUG</code> verb used for?  Why does the application answer <code>200 OK</code> for invalid URLs when using this verb? Is this a security problem? Are there any potential security problems surrounding the <code>DEBUG</code> verb, that ASP.NET developers/system administrators should be aware of?</p>
  
  <p>Any insights/advice/references will be appreciated.</p>