Dynamic port forwarding using SSH uses SOCKS protocol. How does SSH know where a request wants to go? For example if the request is a HTTP request, SSH doesn't understand HTTP, so where does it find out where the HTTP request wants to go? Thanks.
It doesn't. It creates a SOCKS proxy and the client talks the SOCKS protocol to say what it needs to do. There are no "http" requests at this layer.
The web browser speaks "SOCKS" language to say 'connect me to XYZ' and once the connection is made then it speaks HTTP (or HTTPS) to the remote server.
Similarly, a SOCKS aware SMTP client could talk SOCKS and say 'connect me to ABC' and then speaks SMTP.