bitcoin-cli resides in the same directory as bitcoind and bitcoin-qt
You communicate with port 8332 through HTTP POST, using JSON. The communication is in plaintext.
Example for
getbestblockhash:
POST / HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Type: application/json
Authorization: Basic xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Length: 49
{"method":"getbestblockhash","params":[],"id":1}
Where "xxx...x" is base64 encoded username:password or the base64 of the content of the .cookie file (__cookie__:...). For example foo:12345 would result in Zm9vOjEyMzQ1.
Please note, that all newlines above are "\r\n", except after the very last line, which is only "\n".
You'd get a result:
HTTP/1.1 200 OK
Content-Type: application/json
Date: Thu, 14 Oct 2021 19:28:01 GMT
Content-Length: 98
Connection: close
{"result":"000000000000000000064613309ca3e8232397b467af98790b3cc3ac23479f80","error":null,"id":1}