I was looking at the TLS handshake and I noticed that the client will send its list of supported cipher suites and the server will select a cipher suite. The server never sends its list of supported cipher suites. How does a client like SSLLabs know the cipher suites that the server supports? Also, I noticed that SSLLabs only sends one request to the server.
In TLS the client announces what kind of ciphers it supports inside the ClientHello and the server picks a cipher from these which is supported on the server too. While one cannot query the server ciphers directly from the client side one can simply take all known ciphers, construct a ClientHello with each of these and check how the server reacts to this ClientHello - i.e. if the server is accepting the cipher or not.
By intelligently combining multiple ciphers in the ClientHello one can speed up this process and also determine which ciphers the server prefers against others (i.e. cipher order). And that's exactly what SSLLabs is doing for determining the ciphers and also for getting supported SSL/TLS protocol versions and other features of the server.
Also, I noticed that SSLLabs only sends one request to the server.
If you look into the access log of your web server you'll see only HTTP(S) requests. But, most tests done by the SSLLabs scanner don't result in a completed HTTP request. Instead they already stop in the middle of a TLS handshake. These requests will not be shown in the access log of the web server but you'll see them if you are doing a packet capture.