Which of the following wordlists is BEST for cracking MD5 password hashes of an application's users from a compromised database?

rockyou.txt was derived from the 2009 RockYou data breach and contains approximately 14 million real plaintext passwords used by actual users, making it highly effective against human-chosen passwords stored as MD5 hashes. Because MD5 is a fast, unsalted hash in many legacy applications, dictionary attacks using rockyou.txt can recover a large percentage of common passwords quickly. It is the de facto first-choice wordlist for password auditing in tools like Hashcat and John the Ripper.

dirb's big.txt is a web content discovery wordlist containing directory and file names, not passwords, and is inappropriate for hash cracking.

The wfuzz SQL injection wordlist contains SQL syntax payloads for fuzzing web inputs, not human-chosen password candidates.

Metasploit's root_userpass.txt contains default service credentials for common network devices and services, not the general user password patterns found in application databases.