How a transaction proves its ownership of the its source, which can be one or multiple unspent output?
Assume you understand how public-key cryptography works. In short, one can verify the ownership of an address by checking the signature. A valid signature can only be generated by the private key owner.

The detail of signature verification in Bitcoin is described here

Without digging into the details, OP_xxx are stack operations. For example, OP_DUP is to duplicate top of the stack. Basically it 


first hashes the public key by operation OP_HASH160 and check if the result is identical to pubKeyHash by operation OP_EQUALVERIFY
then verifies sig and pubKey by operation OP_CHECKSIG


You can read more about OP_CHECKSIG here