Firstly, I would hazard a guess that 90% of the time it's the first IP address in your subnet (so,
10.10.5.0/24, it would be
10.10.5.1) - although my network has one on
.17 and one on
.23 (and nothing at all on
.1); so make of that what you will.
If it's a wifi network, you could listen in promiscious mode and look at what the most common destination for external traffic is, and if others are using the gateway, you can deduce it from there (by greatly reducing the number of IPs to check with).
If it's a fully switched network, things become a lot harder, but what I have done in the past is watch ARP requests and systematically go through the most heavily advertising ARP devices.
But this is all a long way of saying no, there is no way to tell with 100% certainty what IP address the network gateway resides on, or if the network even has a gateway.
Practical example: I once inherited a watchguard firewall, and I had its passphrases, but no idea what network it was listening on, which is much like your theoretical predicament. What I ended up doing was fireing up Wireshark and started capturing ARP traffic. After a while, the MAC address of the watchguard box started showing up in global broadcast traffic, doing gratuitious ARPs, looking for an IP address of some unknown, pre-configured device. From there it was pretty simple to set myself on the right subnet and find its IP address.
Al West brings up an interesting point - on IPv6 gateways are fairly easy to find if they use autoconfiguration - each router advertises itself (through an RA), you can just listen for them. If it's a DHCP network, or a network with no autoconfiguration OR DHCP the same rules apply as above