Oracle 11i / 12 APPS Password Cracker

In Oracle EBS 11i and R12, the APPS password is used to encrypt FND user credentials and the combination is stored in FND_USER tables, ENCRYPTED_FOUNDATION_PASSWORD column. Any valid combination of login name, password, and the hash code should able to decrypt the APPS password.

To decrypt the APPS password, you can use any login name as long as you know the password for this user; or you can use the internal user GUEST, which should be available in all instances.
The default password for user GUEST is ORACLE. Your DBA may change it to something else but you can find the value from this query:

SELECT B.PROFILE_OPTION_VALUE
  FROM FND_PROFILE_OPTIONS A
     , FND_PROFILE_OPTION_VALUES B
 WHERE A.PROFILE_OPTION_NAME='GUEST_USER_PWD'
   AND B.PROFILE_OPTION_ID=A.PROFILE_OPTION_ID; 

The Foundation Hash can be obtained by:

SELECT ENCRYPTED_FOUNDATION_PASSWORD 
  FROM FND_USER WHERE USER_NAME='GUEST';
-- Or any username of your choice.

Just to remind that password could be case-sensitive, depends on the profile option. Use this query to check the security measure on the password configuration of your instance:

SELECT A.PROFILE_OPTION_NAME
     , B.PROFILE_OPTION_VALUE
  FROM FND_PROFILE_OPTIONS A
     , FND_PROFILE_OPTION_VALUES B
 WHERE A.PROFILE_OPTION_NAME LIKE 'SIGNON%PASSWORD%'
   AND B.PROFILE_OPTION_ID=A.PROFILE_OPTION_ID;

Download the jar file appsPwd.jar, and run it by java -jar appsPwd.jar (JRE 6 or higher). Put your combination of your FND username, password, and ENCRYPTED_FOUNDATION_PASSWORD in the program. Click the button to get the almighty APPS password !