For information regarding differences between package managers, I advise you to
look at the Pacman
Rosetta. This page is
oriented towards Pacman, Arch Linux's package
manager, but it is effective at pointing out the differences between several
other major package managers as well.
In the Pacman Rosetta, look at the entry that says, "Displays packages which
provide the given exp..." The commands provided there are useful for
determining which packages provide which commands.
Each distribution makes its own little choices. These little choices add up to
create large sets of differences between distributions. Here are some examples
that I am familiar with:
Arch Linux's default version of Python is 3. Many other distributions still
use Python 2.
Each distribution chooses a default init
system. Arch uses Systemd.
Slackware, Debian, and
Red Hat use SysV initscripts. Ubuntu uses Upstart.
Distributions have different interpretations of the
FHS. Arch Linux
has a single default directory for executable files.
/usr/local/bin are symlinks to
/usr/bin. Other distributions assign each of these locations different meanings.
Kali Linux adds a number of packages on top of Debian.
It is basically just Debian plus a set of tools for penetration testing.
Kali maintains its own package
packages in the main (http) repository are pulled from Debian. The packages in
the security repository are maintained and provided by Kali. Kali also comes
with a version of Linux kernel that has wireless drivers patched for injection.
If a distribution is based on another distribution, it tends to keep some
consistency between itself and its parent. If Debian began using Systemd, Kali
would (out of near-necessity and desire) start using Systemd as well. If Kali
didn't follow Debian, it would be unable to use Debian's packages. It all comes
back to the sorts small differences I mentioned above.
Some child distributions differ more from their parent distributions than
others. For example, Ubuntu is based on Debian. It started out as Debian and
made changes on top of it. Now Ubuntu is massively different than Debian. On
the other hand, there's a small Arch-based penetration testing distribution
called BlackArch (disclaimer: I am associated with
it and this is a shameless plug) that is basically just Arch plus a set of penetration testing tools. We
don't even call BlackArch its own distribution in some contexts.