Question: Is there any difference between how GET/POST works while in HTTP or HTTPS protocols?
What is visible in HTTPS GET/POST packet when you try to sniff the data? host IP? domain name? full GET request? 
What information TLS hides after successful handshake?

I can't seem to close this knowledge gap by looking in the internet, there's just no such question asked.

Please advice, make it reference for the internet.

Answer: 
SSL operates between the TCP and HTTP protocol layers. The browser will first lookup the server ip via DNS. This is a plain text lookup that can be sniffed. It will then contact the server on port 443 and establish an encrypted channel. Only then will it send an encrypted POST or GET request URL for the server to fulfill.

* IP addresses are not secured in any way.
* Server name is exposed in the DNS lookup.
* GET and POST URLs and server content responses are encrypted.
[![enter image description here](https://i.stack.imgur.com/cbi4F.png)](https://i.stack.imgur.com/cbi4F.png)
HTTP request is just section of text, generated by the user's browser, gets sent across the Internet. The problem is, it's sent just like this, in plaintext that anyone monitoring the connection can read.
If a website uses HTTP instead of HTTPS, all requests and responses can be read by anyone who is monitoring the session. Essentially, a malicious actor can just read the text in the request or the response and know exactly what information someone is asking for, sending, or receiving.

In HTTPS requests and responses use TLS/SSL.
TLS uses a technology called public key encryption: there are two keys, a public key and a private key, and the public key is shared with client devices via the server's SSL certificate. When a client opens a connection with a server, the two devices use the public and private key to agree on new keys, called session keys, to encrypt further communications between them.

All HTTP requests and responses are then encrypted with these session keys, so that anyone who intercepts communications can only see a random string of characters, not the plaintext.

Description is taken from [here](https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/#:%7E:text=HTTPS%20is%20HTTP%20with%20encryption,uses%20HTTPS%20has%20https%3A%2F%2F.) - quite easy and concise.