In Oracle 11i, there are 2 files where the Apps user password in hard-coded in the file system.
In case you have access to the middle tier, navigate to below files and look for them.
1) Navigate to $IAS_ORACLE_HOME/Apache/modplsql/cfg
Look for wdbsvr.app file.
[DAD_DBNAME]
connect_string = DBNAME
password = apps_password
username = APPS
default_page = fnd_web.ping
document_table = APPS.fnd_lobs_document
document_path = docs
As highlighted above, the password will be stored in this file under the header [DAD_DBNAME].
2) Other location where you can find is; Navigate to $ORACLE_HOME/reports60/Server.
Look for file named CGIcmd.dat
When we open the file, we should see a line like below where you can see apps password hard-coded.
DBNAME_APPS:server=REP60_DBNAME userid=APPS/apps_password@DBNAME destype=cache desformat=html tolerance=0 traceopts=trace_prf tracefile='' errfile='' profile='' logfile='' keyout='' copies=1 cellwrapper='' delimiter='' distribute=no save_rdf=null customize=null cmdfile=null term=null rundebug=no keyin=null %*
Note:
Remember this article is applicable only for Oracle EBS 11i. Not applicable for R12.
