I know this question has already been answered, but I thought I'd add one more piece to it. 

The conversion of the http://localhost/dotnetnuke/Admin/SiteSettings/tabid/39/Default.aspx to the correct page is done with the HttpModule, as correctly stated.  The actual translation of the full Url to /localhost/dotnetnuke/default.aspx?tabid=nn is done by the regex filters in the siteurls.config file.   These match the incoming Url and rewrite it to the value in the 'sendTo' value of the rule.

Your original question was 'how does it know there is a default.aspx' in each subdirectory is probably prompted by the sight of the /default.aspx on the end of each request.  In fact, you don't need to put this there.  There are only two things needed in a Friendly Url for the standard SiteUrls.config rules :

- the /tabid/nn/ path

- an .aspx extension so that IIS can direct the request to ASP.NET, and, accordingly, DNN.

You can actually request http://localhost/dotnetnuke/catch/my/tabid/39/my-pink-flying-pig.aspx and it will still work.  The default.aspx is just there for historical reasons.  The ventrian news articles module uses the ability to replace the /default.aspx with any Url-valid value, as will (I believe based on Gemini) the Blog module in a future release - this gives a better looking and more search-engine friendly page name.

This changes when you enable human friendly Urls (ver 4.6+).  Then the tab path is used to reverse lookup the tab based on the path like /dotnetnuke/mypage.aspx (mypage) and rewrite the Url to /default.aspx?tabid=nn based on the table lookup.

-Bruce