A "Server-Side Includes" attack refers to the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary code remotely. Which web-page file type, if it exists on the w

The .stm extension is associated with streaming media or older FrontPage-era templates and does not specifically indicate that a server is configured to process SSI directives.

Files with the .shtml extension instruct the web server to parse the file for SSI directives before delivering the response to the client. The presence of .shtml files strongly indicates that SSI processing is active, making the server potentially vulnerable to SSI injection where an attacker embeds directives such as <!--#exec cmd='id' --> to execute arbitrary OS commands on the server.

The .rss extension identifies RSS syndication feed files and has no relationship to server-side include processing or the SSI attack surface.

The .cms extension is typically linked to content management system output files and does not signal that the web server parses SSI directives in responses.