There are 2 kinds of middleware
- Global
- Route specific
Global middleware can be found at the top of the HttpKernel class which run for every single incoming request for your app. This is where stuff like converting empty strings to null are done, or handling CORS requests.
Route specific middleware are gathered from various sources: route group definition, individual route or controller. It is also possible to inject this kind of middleware at runtime, which packages like Laravel Nova do to bootstrap the needed services when a request is determined to be a Nova request, but that's out the tangent.
A middleware can also be categorized as either a Before or After middleware. The former will perform some checks before passing on the request to the next middleware in the chain, whereas the latter will capture the application response and do some things with it. For example, you could define an After middleware to add some specific cache headers to the response.
The question is rather broad, but should provide a good understanding.
If you want to find out for yourself, start by looking at the Kernels handle method and go step by step until you reach the ControllerDispatcher.