Package managers
For information regarding differences between package managers, I advise you to look at the Pacman Rosetta. This page is oriented towards Pacman, Arch Linux's package manager, but it is effective at pointing out the differences between several other major package managers as well.
In the Pacman Rosetta, look at the entry that says, "Displays packages which provide the given exp..." The commands provided there are useful for determining which packages provide which commands.
Differences
Each distribution makes its own little choices. These little choices add up to create large sets of differences between distributions. Here are some examples that I am familiar with:
Arch Linux's default version of Python is 3. Many other distributions still use Python 2.
Each distribution chooses a default init system. Arch uses Systemd. Slackware, Debian, and Red Hat use SysV initscripts. Ubuntu uses Upstart.
Distributions have different interpretations of the FHS. Arch Linux has a single default directory for executable files.
/bin
,/sbin
, and/usr/local/bin
are symlinks to/usr/bin
. Other distributions assign each of these locations different meanings.
Kali
Kali Linux adds a number of packages on top of Debian. It is basically just Debian plus a set of tools for penetration testing.
Kali maintains its own package repositories. The packages in the main (http) repository are pulled from Debian. The packages in the security repository are maintained and provided by Kali. Kali also comes with a version of Linux kernel that has wireless drivers patched for injection.
Families
If a distribution is based on another distribution, it tends to keep some consistency between itself and its parent. If Debian began using Systemd, Kali would (out of near-necessity and desire) start using Systemd as well. If Kali didn't follow Debian, it would be unable to use Debian's packages. It all comes back to the sorts small differences I mentioned above.
Some child distributions differ more from their parent distributions than others. For example, Ubuntu is based on Debian. It started out as Debian and made changes on top of it. Now Ubuntu is massively different than Debian. On the other hand, there's a small Arch-based penetration testing distribution called BlackArch (disclaimer: I am associated with it and this is a shameless plug) that is basically just Arch plus a set of penetration testing tools. We don't even call BlackArch its own distribution in some contexts.