The short answer is you don't. The best you can do is look to see if it has anything illegal, like knowing moves it can never learn, but otherwise you can't be sure. A well-hacked pokemon is indistinguishable, byte-for-byte, from a legit one.
If you breed a hacked parent the children will always be legit
unless the child inherits an illegal ball or has an ability that hasn't been officially released yet (like intimidate litten). Check
this page to see what's catchable in which balls.
Also don't try to trade these mons in the wifi section of the forum. While VGC players are much more lenient about these things, the wifi section is completely anal about legality and will ban you even if the parents were suspicious.
Legitimate? You can't. But if you want to see if they're
legal, you can just try using them on battle spot. The games are pretty good at filtering out stuff that's straight up unobtainable, but you'll have to watch out for the ball type again because the games don't check for that.
As long as they pass the battle spot check they can be traded.
At smaller events they just try using your team on battle spot. At larger ones they use a special battle box locking program. But as far as we know, the latter checks for the same things as the former.