Is there any difference between how GET/POST works while in HTTP or HTTPS protocols? What is visible in HTTPS GET/POST packet when you try to sniff the data? host IP? domain name? full GET request? What information TLS hides after successful handshake?
I can't seem to close this knowledge gap by looking in the internet, there's just no such question asked.
Please advice, make it reference for the internet.
HTTP request is just section of text, generated by the user's browser, gets sent across the Internet. The problem is, it's sent just like this, in plaintext that anyone monitoring the connection can read.
If a website uses HTTP instead of HTTPS, all requests and responses can be read by anyone who is monitoring the session. Essentially, a malicious actor can just read the text in the request or the response and know exactly what information someone is asking for, sending, or receiving.
In HTTPS requests and responses use TLS/SSL. TLS uses a technology called public key encryption: there are two keys, a public key and a private key, and the public key is shared with client devices via the server's SSL certificate. When a client opens a connection with a server, the two devices use the public and private key to agree on new keys, called session keys, to encrypt further communications between them.
All HTTP requests and responses are then encrypted with these session keys, so that anyone who intercepts communications can only see a random string of characters, not the plaintext.
Description is taken from here - quite easy and concise.
