I am learning about web security, but I'm very confused about URL Encoding.
On PortSwigger, I learned that the URL http://127.0.0.1/admin
can be written as http://127.0.0.1/%2561dmin
by encoding a
as %61
and then encoding %
again, thus making it %2561
When I try this on my local computer, single URL encoding works.
http://127.0.0.1/%61dmin
is interpreted as http://127.0.0.1/admin
But double URL encoding does not work. http://127.0.0.1/%2561dmin
becomes http://127.0.0.1/%61dmin
I am confused about how server knows how many times it has to decode the URL. And is this always the case or it will only works in some cases (as it didn't work on my localhost and some other places I've tried)?