A "Server-Side Includes" attack refers to the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary code remotely. Which web-page file type, if it exists on the…

Server-Side Includes (SSI) are directives placed in HTML pages that are processed by the web server before the page is sent to the user's browser. Files with extensions like .stm, .shtm, or .shtml explicitly tell the web server to parse them for SSI directives, making these file types strong indicators that SSI is active and thus potentially vulnerable to SSI injection attacks if input is not properly sanitized.

.html files are standard static web pages and do not inherently indicate that Server-Side Includes are being processed, though a server could be configured to do so.

.rss files are used for RSS feeds (Really Simple Syndication) and typically contain XML, not server-side include directives.

.cms is not a standard web-page file type; it might refer to a content management system, but not a file extension indicating SSI processing.