How does the NES Zapper work?

It's a light gun. It has a single light sensor in the tip, which picks up light from the part of the screen it is aimed at. Given that the CRT TVs used at the time essentially instantaneously displayed the signal sent from the console, this was quite sufficient.

I've never used a Zapper myself, but according to the Wikipedia article, it worked as follows: when the trigger is pulled, the console would display a flash of light from the location of each target in sequence. Whichever flash produced a pulse from the sensor indicated a hit target.

Using even finer timing (which, again according to the Wikipedia article, the Zapper was not capable of), arbitrary locations on the screen can be identified by detecting the pulses resulting from the sweep of the electron beam across the screen.

All of this is fundamentally dependent on the low-persistence nature of CRTs: each location on the screen emits light only when the input signal passes them as it sweeps out the entire image. This is very different from modern LCD displays, where each individual pixel is a device which changes state (slowly!) between passing or blocking light from the backlight, and the timing of the display change is dependent on the internal digital processing in the display.

The NES Zapper is a simple photodiode connected to a switch. A photodiode allows current to pass, but only if there is light present. When you pull the trigger, the following happens in quick succession:

• The image of the game is replaced with a totally black screen
• The photodiode is checked to see if it is absorbing light.
• The entire screen is set to black, except for white boxes where the ducks were.
• The photodiode is checked again to see if it is now absorbing light

The hit or miss is registered based on if the first check was "it's dark," and the second was "it's light." In this way, the game can tell whether or not you were just aiming at a static light source, or the "flickering duck" that you were supposed to hit.

If there are multiple targets, and the game had to be able to tell which one you hit, the later steps were repeated, with just one of the objects set to white at a time.

The NES isn't particularly fast at doing these flashes, so it's actually possible to see them if you're watching close enough.

This link has it covered. Essentially,

When you point at a duck and pull the trigger, the computer in the NES blacks out the screen and the Zapper diode begins reception. Then, the computer flashes a solid white block around the targets you’re supposed to be shooting at. The photodiode in the Zapper detects the change in light intensity and tells the computer that it’s pointed at a lit target block.

...This target flashing method helped Nintendo overcome a weakness of older light gun games: cheaters racking up high scores by pointing the gun at a steady light source, like a lamp, and hitting the first target right out of the gate.

And you can find more detail in the patent, filed by Nintendo.