Question: Is there any difference between how GET/POST works while in HTTP or HTTPS protocols?
What is visible in HTTPS GET/POST packet when you try to sniff the data? host IP? domain name? full GET request? 
What information TLS hides after successful handshake?

I can't seem to close this knowledge gap by looking in the internet, there's just no such question asked.

Please advice, make it reference for the internet.

Answer: 
SSL operates between the TCP and HTTP protocol layers. The browser will first lookup the server ip via DNS. This is a plain text lookup that can be sniffed. It will then contact the server on port 443 and establish an encrypted channel. Only then will it send an encrypted POST or GET request URL for the server to fulfill.

* IP addresses are not secured in any way.
* Server name is exposed in the DNS lookup.
* GET and POST URLs and server content responses are encrypted.
The entire request , and the response as well is encrypted for https. A middle man doing a [Man in the middle attack](http://en.wikipedia.org/wiki/Man-in-the-middle_attack) , can only get the destination host and port, by intercepting.

This [Google Answer](http://answers.google.com/answers/threadview/id/758002.html#answer) explains it properly. To quote

`HTTPS Establishes an underlying SSL conenction before any HTTP data is
transferred. This ensures that all URL data (with the exception of
hostname, which is used to establish the connection) is carried solely
within this encrypted connection and is protected from
man-in-the-middle attacks in the same way any HTTP data is.`

In terms of the TCP/IP stack, HTTP, an application layer protocol, uses TCP layer security. First , a secure TCP connection is established, then only the request is sent and response received.