Link to this headingReturn2

Link to this headingret2data

Inject data into the data section of the mapped executable then jump to it.

Link to this headingret2strcpy

Copy from stack to any -wx address space

Link to this headingret2gets

inject input data directly into any -wx address space

Link to this headingret2syscall

https://ret2basic.gitbook.io/ctfnote/pwn/linux-exploitation/rop/ret2syscall
https://book.hacktricks.xyz/binary-exploitation/rop-return-oriented-programing/rop-syscall-execv

Link to this headingret2plt

Use plt to change pointer to jump to