You're right; actually tor reside in the application layer I think (above TLS).
Although conceptually speaking it is itself a transport layer I guess.
Layer 5 would be HTTP, layer 6 would be the content (JPEG, MP4, etc.), and layer 7 would be the application serving or sending the HTTP requests/content.