For penetration testing, I am planning to decompile the published source code of ASP.NET web application. This has to done by the QA. But I am struggling to check this. Is there any tool or any technique to perform this?
If you have access to the DLLs you can use Reflector. Unless you are accessing the server internally you would not typically have access to the DLLs.
If you are doing an internal security audit (Someone who has access to your network) than they would quite possibly have access to the DLLs. This could lead to a scenario where they could decompile the code. It won't be the exact same source code but it will be very close. I would be more concerned of if they can access your source control, database or encryption/secure modules than the source code.
If you are doing an external security audit, one where the attacker does not have access to the internal network, you can attempt to breach the network. The easiest way to do this is to collect data about the network, what model/version of server, database, daemons etc and then compare with the multitude of vulnerability lists. Kali (Backtrack) Linux offers a great suite of tools to utilize any known risks to breach the network. Once in, there is several things that could be done to obtain and decompile the DLLs.