There is a lot of tools out there to do a lot of things with, like sniffing, scanning, and even backdoors. However, I have a really hard time trusting these tools. When I install them at home and target my computers, how can I trust that the tools I'm using do not harm me?
Example 1 - Metasploit, Meterpreter especially: I use Metasploit. With a trusted exploit, that gives me a Meterpreter connection. How can I trust, that Meterpreter in fact does what it claims to do, and does not open backdoors here and there? I consider this tool an industry standard for its purpose in a sense, but still, do you trust it?
Example 2 - Google: Ratproxy is a product of Google, and that sounds trustworthy, right? It's also open source. But it's just Google that develops it? It would probably take me a year to read and understand all the code. How can this be trusted? Do you trust it?
Example 4 - Burp Suite: Burp Suite really seems to be the #1 "HTTP-proxy and more" tool to use, but it's proprietary and not open source. It's written in Java, but probably properly obfuscated, so that we can't know exactly what it does. Trustworthy? "Of course, use it! All my friends use it..."!?
Example 5 - Bundles: There are some security tool bundles out there. Specifically, I would like to discuss Kali/Backtrack. It comes with a lot of tools. Do you trust their pick of tools? Do you trust the company itself? Of course, with that many tools, they can't know everything about every tool, but they are smart guys, I guess, so the question is, if they added just the tools they trust themselves, or they just added everything that their users would like to see in the bundle/distribution?
Please discuss around those examples and maybe come up your own examples. What tools should we trust? Why? What is your definition of trust? Mine is, that I would run it on my own desktop computer (not in VM).
EDIT: Also, how can we distinguish between tools that were created with the following philosophies:
"I'll make this tool because I hate script kiddies, so I will harm them and use it for my own purposes.", and
"I'll make this tool to make my life as a security researcher and pen-tester easier, and if it's good, I'll share it with the community."