I am learning about web security, but I'm very confused about URL Encoding.
On PortSwigger, I learned that the URL
can be written as
%61 and then encoding
% again, thus making it
When I try this on my local computer, single URL encoding works.
http://127.0.0.1/%61dmin is interpreted as
But double URL encoding does not work.
I am confused about how server knows how many times it has to decode the URL. And is this always the case or it will only works in some cases (as it didn't work on my localhost and some other places I've tried)?