I know the theory about proxies, what they are and their purposes.
Sometimes, HTTP(s) proxies are used within a company to filter outgoing network, for example, to prevent anything but HTTP/HTTPs. I know a person inside such a company, and he can’t even use SSH, on any port. On the other side, all ports seems to be open, as long as he uses it for HTTP or HTTPs (or just TLS, I don’t know).
In theory, if I look at the OSI model, everything that comes after the session layer is encrypted. So, the only relevant things a proxy can see when a user browses a HTTPs site is IP, port and maybe domain name in certain cases, right?
It may be very dumb, but I can‘t find an answer to this question:
How it is possible for an HTTPs proxy to detect a packet as HTTPs (and not just TLS), if anything after the TLS header is encrypted?
I tried to sniff my local network, to search for a clue but I didn’t see a mention of the application protocol in session or transport layers.